[Webkit-unassigned] [Bug 141596] New: FEGaussianBlur::calculateUnscaledKernelSize does unspeakable things with signed and unsigned values

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=141596

            Bug ID: 141596
           Summary: FEGaussianBlur::calculateUnscaledKernelSize does
                    unspeakable things with signed and unsigned values
    Classification: Unclassified
           Product: WebKit
           Version: 528+ (Nightly build)
          Hardware: All
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Layout and Rendering
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: bfulgham at webkit.org

The 'calculateUnscaledKernelSize' method improperly treats signed and unsigned values as interchangeable. This creates problems when we have extremely large stdDevication values (such as in the test case "css3/filters/huge-blur-value.html"). When the standard deviation supplied to the routine overflows a int value, we pass 

In this pathological case, the Std Deviation used for the blur is the float 2.14748365E+9. When this is cast as an unsigned, then assigned to a signed integer, we end up with -257759744.

The minimum of -257759744 and 500 turns out to be -257759744.

    IntSize kernelSize;

    // Limit the kernel size to 500. A bigger radius won't make a big difference for the result image but
    // inflates the absolute paint rect too much. This is compatible with Firefox' behavior.
    if (stdDeviation.x()) {
        int size = std::max<unsigned>(2, static_cast<unsigned>(floorf(stdDeviation.x() * gaussianKernelFactor() + 0.5f)));
        kernelSize.setWidth(std::min(size, gMaxKernelSize));
    }

Later, this kernelSize is cast back to an unsigned, bypassing this ceiling, and subjecting other code to values far in excess of 500.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150214/d22f197f/attachment-0002.html>