Mirrors/servo
1
0
Fork 0
mirror of https://github.com/servo/servo.git synced 2025-08-03 20:50:07 +01:00
Code Issues Projects Releases Packages Wiki Activity

script: Prevent an integer overflow that was hitting us on htmlimageelement.rs

Browse source
This commit is contained in:
Emilio Cobos Álvarez 2016-09-26 17:28:35 +02:00
parent bdf1d179ba
commit fdd8471310
No known key found for this signature in database
GPG key ID: 056B727BB9C1027C
1 changed files with 15 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

17
components/script/dom/htmlimageelement.rs
View file

@ -2,7 +2,7 @@
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
use app_units::Au;
use app_units::{Au, AU_PER_PX};
use dom::attr::Attr;
use dom::bindings::cell::DOMRefCell;
use dom::bindings::codegen::Bindings::HTMLImageElementBinding;
@ -28,6 +28,7 @@ use net_traits::image_cache_thread::{ImageResponder, ImageResponse};
use script_runtime::CommonScriptMsg;
use script_runtime::ScriptThreadEventCategory::UpdateReplacedElement;
use script_thread::Runnable;
use std::i32;
use std::sync::Arc;
use string_cache::Atom;
use style::attr::{AttrValue, LengthOrPercentageOrAuto};
@ -442,7 +443,19 @@ fn image_dimension_setter(element: &Element, attr: Atom, value: u32) {
} else {
value
};
let dim = LengthOrPercentageOrAuto::Length(Au::from_px(value as i32));
// FIXME: There are probably quite a few more cases of this. This is the
// only overflow that was hitting on automation, but we should consider what
// to do in the general case case.
//
// See <https://github.com/servo/app_units/issues/22>
let pixel_value = if value > (i32::MAX / AU_PER_PX) as u32 {
0
} else {
value
};
let dim = LengthOrPercentageOrAuto::Length(Au::from_px(pixel_value as i32));
let value = AttrValue::Dimension(value.to_string(), dim);
element.set_attribute(&attr, value);
}