Commit fe528a6d authored by Mike Perry's avatar Mike Perry
Browse files

Backport two integer overflow patches. 

https://hg.mozilla.org/mozilla-central/rev/14ad832ecbcd
https://hg.mozilla.org/mozilla-central/rev/c00387255d25

https://bugzilla.mozilla.org/show_bug.cgi?id=922603
https://bugzilla.mozilla.org/show_bug.cgi?id=811122
parent f1960dd2

image/src/imgFrame.cpp

+3 −7
Original line number Diff line number Diff line
@@ -19,6 +19,7 @@ static bool gDisableOptimize = false; 
#include "cairo.h"

#include "GeckoProfiler.h"

#include "mozilla/Likely.h"

#include "mozilla/CheckedInt.h"



#if defined(XP_WIN)
@@ -54,13 +55,8 @@ static bool AllowedImageSize(int32_t aWidth, int32_t aHeight) 
  }



  // check to make sure we don't overflow a 32-bit

  int32_t tmp = aWidth * aHeight;

  if (MOZ_UNLIKELY(tmp / aHeight != aWidth)) {

    NS_WARNING("width or height too large");

    return false;

  }

  tmp = tmp * 4;

  if (MOZ_UNLIKELY(tmp / 4 != aWidth * aHeight)) {

  mozilla::CheckedInt32 requiredBytes = mozilla::CheckedInt32(aWidth) * mozilla::CheckedInt32(aHeight) * 4;

  if (MOZ_UNLIKELY(!requiredBytes.isValid())) {

    NS_WARNING("width or height too large");

    return false;

  }

js/src/vm/Interpreter-inl.h

+2 −6
Original line number Diff line number Diff line
@@ -368,13 +368,9 @@ AddOperation(JSContext *cx, HandleScript script, jsbytecode *pc, 
{

    if (lhs.isInt32() && rhs.isInt32()) {

        int32_t l = lhs.toInt32(), r = rhs.toInt32();

        int32_t sum = l + r;

        if (JS_UNLIKELY(bool((l ^ sum) & (r ^ sum) & 0x80000000))) {

            res->setDouble(double(l) + double(r));

        double d = double(l) + double(r);

        if (!res->setNumber(d))

            types::TypeScript::MonitorOverflow(cx, script, pc);

        } else {

            res->setInt32(sum);

        }

        return true;

    }