From 37eab5c66e609f9d98203c58feb740d23265ea2e Mon Sep 17 00:00:00 2001 From: Pedro Pontes Date: Thu, 5 May 2022 15:58:08 +0200 Subject: [PATCH] chore: cherry-pick 5be8e065f43e from chromium (#34040) * chore: cherry-pick 5be8e065f43e from chromium * chore: update patches Co-authored-by: PatchUp <73610968+patchup[bot]@users.noreply.github.com> Co-authored-by: Electron Bot --- patches/chromium/.patches | 1 + .../chromium/cherry-pick-5be8e065f43e.patch | 36 +++++++++++++++++++ 2 files changed, 37 insertions(+) create mode 100644 patches/chromium/cherry-pick-5be8e065f43e.patch diff --git a/patches/chromium/.patches b/patches/chromium/.patches index d33d934e13d40..014e7c18033ff 100644 --- a/patches/chromium/.patches +++ b/patches/chromium/.patches @@ -175,6 +175,7 @@ skia_renderer_-_don_t_explicitly_clip_scissor_for_large_transforms.patch skia_renderer_use_rectf_intersect_in_applyscissor.patch cherry-pick-1a31e2110440.patch m100_change_ownership_of_blobbytesprovider.patch +cherry-pick-5be8e065f43e.patch m96-lts_add_bounds_check_to_webgpudecoderimpl_dorequestdevice.patch cherry-pick-5ff02e4d7368.patch cherry-pick-12ba78f3fa7a.patch diff --git a/patches/chromium/cherry-pick-5be8e065f43e.patch b/patches/chromium/cherry-pick-5be8e065f43e.patch new file mode 100644 index 0000000000000..d019df82af33d --- /dev/null +++ b/patches/chromium/cherry-pick-5be8e065f43e.patch @@ -0,0 +1,36 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Gregg Tavares +Date: Fri, 29 Apr 2022 15:23:33 +0000 +Subject: Check for error when calling ComputeImageSizeInBytes + +(cherry picked from commit f3244fe50ba6c64ab6a75f1370d8dd983927fae6) + +Bug: chromium:1304987 +Change-Id: I8311231156fca3200ce74d79db59d910a1a0e33a +Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3556686 +Commit-Queue: Gregg Tavares +Cr-Original-Commit-Position: refs/heads/main@{#986304} +Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3597078 +Owners-Override: Victor-Gabriel Savu +Reviewed-by: Victor-Gabriel Savu +Commit-Queue: Roger Felipe Zanoni da Silva +Cr-Commit-Position: refs/branch-heads/4664@{#1609} +Cr-Branched-From: 24dc4ee75e01a29d390d43c9c264372a169273a7-refs/heads/main@{#929512} + +diff --git a/third_party/blink/renderer/platform/graphics/gpu/webgl_image_conversion.cc b/third_party/blink/renderer/platform/graphics/gpu/webgl_image_conversion.cc +index 16babfa9bcf98d640bc32be99fc8641e3f459a4b..767b477d50d79b2bca8dcb09d21d3c474d825fca 100644 +--- a/third_party/blink/renderer/platform/graphics/gpu/webgl_image_conversion.cc ++++ b/third_party/blink/renderer/platform/graphics/gpu/webgl_image_conversion.cc +@@ -3996,8 +3996,10 @@ bool WebGLImageConversion::ExtractTextureData( + data.resize(width * height * bytes_per_pixel); + + unsigned image_size_in_bytes, skip_size_in_bytes; +- ComputeImageSizeInBytes(format, type, width, height, 1, unpack_params, +- &image_size_in_bytes, nullptr, &skip_size_in_bytes); ++ if (ComputeImageSizeInBytes(format, type, width, height, 1, unpack_params, ++ &image_size_in_bytes, nullptr, ++ &skip_size_in_bytes) != GL_NO_ERROR) ++ return false; + const uint8_t* src_data = static_cast(pixels); + if (skip_size_in_bytes) { + src_data += skip_size_in_bytes;