From c0db95d3dda1865d4c6bf0666b0e7439b40b9bf2 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 21 Apr 2024 20:35:44 +0200 Subject: Merging upstream version 115.10.0esr. Signed-off-by: Daniel Baumann --- gfx/2d/DrawTargetSkia.cpp | 2 +- gfx/ots/src/ots.h | 13 ++++++------- gfx/ots/src/stat.cc | 21 ++++++++++++--------- gfx/wr/webrender/src/renderer/upload.rs | 10 ++++++---- 4 files changed, 25 insertions(+), 21 deletions(-) (limited to 'gfx') diff --git a/gfx/2d/DrawTargetSkia.cpp b/gfx/2d/DrawTargetSkia.cpp index 0ddf9fef52..77d9d31faa 100644 --- a/gfx/2d/DrawTargetSkia.cpp +++ b/gfx/2d/DrawTargetSkia.cpp @@ -1398,7 +1398,7 @@ void DrawTargetSkia::Mask(const Pattern& aSource, const Pattern& aMask, SkPaint maskPaint; SetPaintPattern(maskPaint, aMask, lock); - sk_sp maskShader(maskPaint.getShader()); + sk_sp maskShader(maskPaint.refShader()); if (!maskShader && maskPaint.getAlpha() != 0xFF) { if (maskPaint.getAlpha() == 0) { return; diff --git a/gfx/ots/src/ots.h b/gfx/ots/src/ots.h index 434e068d48..7e3625c737 100644 --- a/gfx/ots/src/ots.h +++ b/gfx/ots/src/ots.h @@ -87,8 +87,7 @@ class Buffer { if (n_bytes > 1024 * 1024 * 1024) { return OTS_FAILURE(); } - if ((offset_ + n_bytes > length_) || - (offset_ > length_ - n_bytes)) { + if (length_ < n_bytes || offset_ > length_ - n_bytes) { return OTS_FAILURE(); } if (buf) { @@ -99,7 +98,7 @@ class Buffer { } inline bool ReadU8(uint8_t *value) { - if (offset_ + 1 > length_) { + if (length_ < 1 || offset_ > length_ - 1) { return OTS_FAILURE(); } *value = buffer_[offset_]; @@ -108,7 +107,7 @@ class Buffer { } bool ReadU16(uint16_t *value) { - if (offset_ + 2 > length_) { + if (length_ < 2 || offset_ > length_ - 2) { return OTS_FAILURE(); } std::memcpy(value, buffer_ + offset_, sizeof(uint16_t)); @@ -122,7 +121,7 @@ class Buffer { } bool ReadU24(uint32_t *value) { - if (offset_ + 3 > length_) { + if (length_ < 3 || offset_ > length_ - 3) { return OTS_FAILURE(); } *value = static_cast(buffer_[offset_]) << 16 | @@ -133,7 +132,7 @@ class Buffer { } bool ReadU32(uint32_t *value) { - if (offset_ + 4 > length_) { + if (length_ < 4 || offset_ > length_ - 4) { return OTS_FAILURE(); } std::memcpy(value, buffer_ + offset_, sizeof(uint32_t)); @@ -147,7 +146,7 @@ class Buffer { } bool ReadR64(uint64_t *value) { - if (offset_ + 8 > length_) { + if (length_ < 8 || offset_ > length_ - 8) { return OTS_FAILURE(); } std::memcpy(value, buffer_ + offset_, sizeof(uint64_t)); diff --git a/gfx/ots/src/stat.cc b/gfx/ots/src/stat.cc index f6f65fdf60..0eeaffb1c6 100644 --- a/gfx/ots/src/stat.cc +++ b/gfx/ots/src/stat.cc @@ -48,10 +48,6 @@ bool OpenTypeSTAT::Parse(const uint8_t* data, size_t length) { this->minorVersion = 2; } - if (this->designAxisSize < sizeof(AxisRecord)) { - return Drop("Invalid designAxisSize"); - } - size_t headerEnd = table.offset(); if (this->designAxisCount == 0) { @@ -60,9 +56,13 @@ bool OpenTypeSTAT::Parse(const uint8_t* data, size_t length) { this->designAxesOffset = 0; } } else { + if (this->designAxisSize < sizeof(AxisRecord)) { + return Drop("Invalid designAxisSize"); + } if (this->designAxesOffset < headerEnd || - size_t(this->designAxesOffset) + - size_t(this->designAxisCount) * size_t(this->designAxisSize) > length) { + size_t(this->designAxesOffset) > length || + size_t(this->designAxisCount) * size_t(this->designAxisSize) > + length - size_t(this->designAxesOffset)) { return Drop("Invalid designAxesOffset"); } } @@ -95,8 +95,9 @@ bool OpenTypeSTAT::Parse(const uint8_t* data, size_t length) { } } else { if (this->offsetToAxisValueOffsets < headerEnd || - size_t(this->offsetToAxisValueOffsets) + - size_t(this->axisValueCount) * sizeof(uint16_t) > length) { + size_t(this->offsetToAxisValueOffsets) > length || + size_t(this->axisValueCount) * sizeof(uint16_t) > + length - size_t(this->offsetToAxisValueOffsets)) { return Drop("Invalid offsetToAxisValueOffsets"); } } @@ -107,7 +108,9 @@ bool OpenTypeSTAT::Parse(const uint8_t* data, size_t length) { if (!table.ReadU16(&axisValueOffset)) { return Drop("Failed to read axis value offset"); } - if (this->offsetToAxisValueOffsets + axisValueOffset > length) { + // We already checked that offsetToAxisValueOffsets doesn't exceed length, + // so this subtraction will not underflow. + if (axisValueOffset > length - this->offsetToAxisValueOffsets) { return Drop("Invalid axis value offset"); } table.set_offset(this->offsetToAxisValueOffsets + axisValueOffset); diff --git a/gfx/wr/webrender/src/renderer/upload.rs b/gfx/wr/webrender/src/renderer/upload.rs index 0ba053cd76..a1155ecef4 100644 --- a/gfx/wr/webrender/src/renderer/upload.rs +++ b/gfx/wr/webrender/src/renderer/upload.rs @@ -43,6 +43,7 @@ use crate::profiler; use crate::render_api::MemoryReport; pub const BATCH_UPLOAD_TEXTURE_SIZE: DeviceIntSize = DeviceIntSize::new(512, 512); +const BATCH_UPLOAD_FORMAT_COUNT: usize = 4; /// Upload a number of items to texture cache textures. /// @@ -627,10 +628,10 @@ pub struct UploadTexturePool { /// The textures in the pool associated with a last used frame index. /// /// The outer array corresponds to each of teh three supported texture formats. - textures: [VecDeque<(Texture, u64)>; 3], + textures: [VecDeque<(Texture, u64)>; BATCH_UPLOAD_FORMAT_COUNT], // Frame at which to deallocate some textures if there are too many in the pool, // for each format. - delay_texture_deallocation: [u64; 3], + delay_texture_deallocation: [u64; BATCH_UPLOAD_FORMAT_COUNT], current_frame: u64, /// Temporary buffers that are used when using staging uploads + glTexImage2D. @@ -646,8 +647,8 @@ pub struct UploadTexturePool { impl UploadTexturePool { pub fn new() -> Self { UploadTexturePool { - textures: [VecDeque::new(), VecDeque::new(), VecDeque::new()], - delay_texture_deallocation: [0; 3], + textures: [VecDeque::new(), VecDeque::new(), VecDeque::new(), VecDeque::new()], + delay_texture_deallocation: [0; BATCH_UPLOAD_FORMAT_COUNT], current_frame: 0, temporary_buffers: Vec::new(), min_temporary_buffers: 0, @@ -660,6 +661,7 @@ impl UploadTexturePool { ImageFormat::RGBA8 => 0, ImageFormat::BGRA8 => 1, ImageFormat::R8 => 2, + ImageFormat::R16 => 3, _ => { panic!("unexpected format"); } } } -- cgit v1.2.3