Browse Source

Fixed segfault when sw/sh putImageData() values are to large

v1.x
Tj Holowaychuk 14 years ago
parent
commit
085435d416
  1. 10
      src/CanvasRenderingContext2d.cc
  2. 14
      test/public/tests.js

10
src/CanvasRenderingContext2d.cc

@ -393,7 +393,7 @@ Context2d::New(const Arguments &args) {
* Put image data.
*
* - imageData, dx, dy
* - imageData, dx, dy, sx, sy, dw, dh
* - imageData, dx, dy, sx, sy, sw, sh
*
*/
@ -424,7 +424,6 @@ Context2d::PutImageData(const Arguments &args) {
, rows
, cols;
// TODO: spec boundaries
switch (args.Length()) {
// imageData, dx, dy
case 3:
@ -432,16 +431,19 @@ Context2d::PutImageData(const Arguments &args) {
rows = arr->height();
break;
// imageData, dx, dy, sx, sy, dw, dh
case 7: {
case 7:
sx = args[3]->NumberValue();
sy = args[4]->NumberValue();
sw = args[5]->NumberValue();
sh = args[6]->NumberValue();
if (sx < 0) sw += sx, sx = 0;
if (sy < 0) sh += sy, sy = 0;
if (sx + sw > arr->width()) sw = arr->width() - sx;
if (sy + sh > arr->height()) sh = arr->height() - sy;
cols = sw;
rows = sh;
dx += sx;
dy += sy;
}
break;
default:
return ThrowException(Exception::Error(String::New("invalid arguments")));

14
test/public/tests.js

@ -1554,12 +1554,24 @@ tests['putImageData() 8'] = function(ctx){
ctx.fillRect(j*25,i*25,25,25);
}
}
ctx.strokeRect(60,60,50,30);
ctx.translate(20,20);
var data = ctx.getImageData(0,0,50,50);
ctx.putImageData(data,-10,-10,0,20,35,30);
};
tests['putImageData() 9'] = function(ctx){
for (i=0;i<6;i++){
for (j=0;j<6;j++){
ctx.fillStyle = 'rgb(' + Math.floor(255-42.5*i) + ',' +
Math.floor(255-42.5*j) + ',0)';
ctx.fillRect(j*25,i*25,25,25);
}
}
ctx.translate(20,20);
var data = ctx.getImageData(0,0,50,50);
ctx.putImageData(data,-10,-10,0,20,500,500);
};
tests['putImageData() alpha'] = function(ctx){
ctx.fillStyle = 'rgba(255,0,0,0.5)'
ctx.fillRect(0,0,50,100);

Loading…
Cancel
Save