Skip to content

GitLab

T
tangled
Commit e524403c authored by Reilly Grant's avatar Reilly Grant Committed by Commit Bot
Browse files
Options

[Shape Detection] Check for a neutered ImageData buffer 

Script can transfer the ArrayBuffer created by an instance of ImageData.
In this case the data is no longer available and the ImageData should be
rejected by the detect() API.

Bug: 957522
Change-Id: I2601aa9661303ce1a5fd67044178e2ef83347281
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1600458Reviewed-by: default avatarMiguel Casas <mcasas@chromium.org>
Commit-Queue: Reilly Grant <reillyg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#657738}
parent 60d1253d
Hide whitespace changes
Inline Side-by-side
Showing with 62 additions and 0 deletions
third_party/blink/renderer/modules/shapedetection/shape_detector.cc
View file @ e524403c
...@@ -109,6 +109,12 @@ ScriptPromise ShapeDetector::DetectShapesOnImageData( ...@@ -109,6 +109,12 @@ ScriptPromise ShapeDetector::DetectShapesOnImageData(
return promise; return promise;
} }
if (image_data->BufferBase()->IsNeutered()) {
resolver->Reject(DOMException::Create(DOMExceptionCode::kInvalidStateError,
"The image data has been detached."));
return promise;
}
SkBitmap sk_bitmap; SkBitmap sk_bitmap;
if (!sk_bitmap.tryAllocPixels( if (!sk_bitmap.tryAllocPixels(
SkImageInfo::Make(image_data->width(), image_data->height(), SkImageInfo::Make(image_data->width(), image_data->height(),
......
third_party/blink/web_tests/external/wpt/shape-detection/detection-ImageData-detached.html 0 → 100644
View file @ e524403c
<!DOCTYPE html>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script>
function detachBuffer(buffer) {
window.postMessage('', '*', [buffer]);
}
promise_test(async () => {
let data = new ImageData(1024, 1024);
detachBuffer(data.data.buffer);
let detector = new FaceDetector();
try {
await detector.detect(data);
assert_unreached();
} catch (e) {
assert_equals(e.code, DOMException.INVALID_STATE_ERR);
}
}, 'FaceDetector.detect() rejects on a detached buffer');
promise_test(async () => {
let data = new ImageData(1024, 1024);
detachBuffer(data.data.buffer);
let detector = new BarcodeDetector();
try {
await detector.detect(data);
assert_unreached();
} catch (e) {
assert_equals(e.code, DOMException.INVALID_STATE_ERR);
}
}, 'BarcodeDetector.detect() rejects on a detached buffer');
</script>
third_party/blink/web_tests/shapedetection/detection-ImageData-detached.html 0 → 100644
View file @ e524403c
<!DOCTYPE html>
<script src="../resources/testharness.js"></script>
<script src="../resources/testharnessreport.js"></script>
<script>
function detachBuffer(buffer) {
window.postMessage('', '*', [buffer]);
}
promise_test(async () => {
let data = new ImageData(1024, 1024);
detachBuffer(data.data.buffer);
let detector = new TextDetector();
try {
await detector.detect(data);
assert_unreached();
} catch (e) {
assert_equals(e.code, DOMException.INVALID_STATE_ERR);
}
}, 'TextDetector.detect() rejects on a detached buffer');
</script>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment