Fixed segfault when sw/sh putImageData() values are to large

src/CanvasRenderingContext2d.cc

@@ -393,7 +393,7 @@ Context2d::New(const Arguments &args) {
  * Put image data.
  *
  *  - imageData, dx, dy
- *  - imageData, dx, dy, sx, sy, dw, dh
+ *  - imageData, dx, dy, sx, sy, sw, sh
  *
  */
 
@@ -424,7 +424,6 @@ Context2d::PutImageData(const Arguments &args) {
     , rows
     , cols;
 
-  // TODO: spec boundaries
   switch (args.Length()) {
     // imageData, dx, dy
     case 3:
@@ -432,16 +431,19 @@ Context2d::PutImageData(const Arguments &args) {
       rows = arr->height();
       break;
     // imageData, dx, dy, sx, sy, dw, dh
-    case 7: {
+    case 7:
       sx = args[3]->NumberValue();
       sy = args[4]->NumberValue();
       sw = args[5]->NumberValue();
       sh = args[6]->NumberValue();
+      if (sx < 0) sw += sx, sx = 0;
+      if (sy < 0) sh += sy, sy = 0;
+      if (sx + sw > arr->width()) sw = arr->width() - sx;
+      if (sy + sh > arr->height()) sh = arr->height() - sy;
       cols = sw;
       rows = sh;
       dx += sx; 
       dy += sy; 
-      }
       break;
     default:
       return ThrowException(Exception::Error(String::New("invalid arguments")));

test/public/tests.js

@@ -1554,12 +1554,24 @@ tests['putImageData() 8'] = function(ctx){
       ctx.fillRect(j*25,i*25,25,25);
     }
   }
-  ctx.strokeRect(60,60,50,30);
   ctx.translate(20,20);
   var data = ctx.getImageData(0,0,50,50);
   ctx.putImageData(data,-10,-10,0,20,35,30);
 };
 
+tests['putImageData() 9'] = function(ctx){
+  for (i=0;i<6;i++){
+    for (j=0;j<6;j++){
+      ctx.fillStyle = 'rgb(' + Math.floor(255-42.5*i) + ',' + 
+                       Math.floor(255-42.5*j) + ',0)';
+      ctx.fillRect(j*25,i*25,25,25);
+    }
+  }
+  ctx.translate(20,20);
+  var data = ctx.getImageData(0,0,50,50);
+  ctx.putImageData(data,-10,-10,0,20,500,500);
+};
+
 tests['putImageData() alpha'] = function(ctx){
   ctx.fillStyle = 'rgba(255,0,0,0.5)'
   ctx.fillRect(0,0,50,100);