[Webkit-unassigned] [Bug 48634] fast/images/size-failure.html results in malloc of 2 Gb after switching to WebKit image decoders

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=48634


Adam Barth <abarth at webkit.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #73810|review?, commit-queue?      |review+, commit-queue-
               Flag|                            |




--- Comment #19 from Adam Barth <abarth at webkit.org>  2010-11-12 23:14:01 PST ---
(From update of attachment 73810)
View in context: https://bugs.webkit.org/attachment.cgi?id=73810&action=review

> WebCore/platform/image-decoders/cg/ImageDecoderCG.cpp:63
> +    int backingStoreSize = newWidth * newHeight * sizeof(PixelData);

Is "int" the right type here?  I would have expected size_t.  Do we need to check for overflow?

> WebCore/platform/image-decoders/cg/ImageDecoderCG.cpp:67
> +    if (!backingStoreRef)
> +        return false;
> +    m_backingStore.adoptCF(backingStoreRef);

Are these the right failure semantics?  I guess setSize is called exactly once.  Maybe we should ASSERT something about the state of m_backingStore at the top of the function (e.g., that it's NULL).

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.