Skip to content

Commit 1820645

Browse files
johanvosjohanvos
authored
backports of JDK-8313048, JDK-8313105, JDK-8313056 (#175)
1 parent 9fdfb67 commit 1820645

File tree

17 files changed

+612
-363
lines changed

17 files changed

+612
-363
lines changed

‎modules/javafx.graphics/src/main/java/com/sun/glass/ui/Pixels.java

Lines changed: 19 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -85,25 +85,22 @@ public static int getNativeFormat() {
8585
private final float scaley;
8686

8787
protected Pixels(final int width, final int height, final ByteBuffer pixels) {
88-
this.width = width;
89-
this.height = height;
90-
this.bytesPerComponent = 1;
91-
this.bytes = pixels.slice();
92-
if ((this.width <= 0) || (this.height <= 0) || ((this.width * this.height * 4) > this.bytes.capacity())) {
93-
throw new IllegalArgumentException("Too small byte buffer size "+this.width+"x"+this.height+" ["+(this.width*this.height*4)+"] > "+this.bytes.capacity());
94-
}
95-
96-
this.ints = null;
97-
this.scalex = 1.0f;
98-
this.scaley = 1.0f;
88+
this(width, height, pixels, 1.0f, 1.0f);
9989
}
10090

10191
protected Pixels(final int width, final int height, final ByteBuffer pixels, float scalex, float scaley) {
10292
this.width = width;
10393
this.height = height;
10494
this.bytesPerComponent = 1;
10595
this.bytes = pixels.slice();
106-
if ((this.width <= 0) || (this.height <= 0) || ((this.width * this.height * 4) > this.bytes.capacity())) {
96+
97+
if (this.width <= 0 || this.height <= 0 ||
98+
this.width > ((Integer.MAX_VALUE / 4) / this.height)) {
99+
100+
throw new IllegalArgumentException("Invalid width*height");
101+
}
102+
103+
if ((this.width * this.height * 4) > this.bytes.capacity()) {
107104
throw new IllegalArgumentException("Too small byte buffer size "+this.width+"x"+this.height+" ["+(this.width*this.height*4)+"] > "+this.bytes.capacity());
108105
}
109106

@@ -113,25 +110,22 @@ protected Pixels(final int width, final int height, final ByteBuffer pixels, flo
113110
}
114111

115112
protected Pixels(final int width, final int height, IntBuffer pixels) {
116-
this.width = width;
117-
this.height = height;
118-
this.bytesPerComponent = 4;
119-
this.ints = pixels.slice();
120-
if ((this.width <= 0) || (this.height <= 0) || ((this.width * this.height) > this.ints.capacity())) {
121-
throw new IllegalArgumentException("Too small int buffer size "+this.width+"x"+this.height+" ["+(this.width*this.height)+"] > "+this.ints.capacity());
122-
}
123-
124-
this.bytes = null;
125-
this.scalex = 1.0f;
126-
this.scaley = 1.0f;
113+
this(width, height, pixels, 1.0f, 1.0f);
127114
}
128115

129116
protected Pixels(final int width, final int height, IntBuffer pixels, float scalex, float scaley) {
130117
this.width = width;
131118
this.height = height;
132119
this.bytesPerComponent = 4;
133120
this.ints = pixels.slice();
134-
if ((this.width <= 0) || (this.height <= 0) || ((this.width * this.height) > this.ints.capacity())) {
121+
122+
if (this.width <= 0 || this.height <= 0 ||
123+
this.width > ((Integer.MAX_VALUE / 4) / this.height)) {
124+
125+
throw new IllegalArgumentException("Invalid width*height");
126+
}
127+
128+
if ((this.width * this.height) > this.ints.capacity()) {
135129
throw new IllegalArgumentException("Too small int buffer size "+this.width+"x"+this.height+" ["+(this.width*this.height)+"] > "+this.ints.capacity());
136130
}
137131

@@ -238,6 +232,7 @@ public final void asByteBuffer(ByteBuffer bb) {
238232
throw new RuntimeException("Too small buffer.");
239233
}
240234
_fillDirectByteBuffer(bb);
235+
bb.rewind();
241236
}
242237

243238
// This method is called from the native code to reduce the number of JNI up-calls.

‎modules/javafx.graphics/src/main/java/com/sun/glass/ui/gtk/GtkPixels.java

Lines changed: 7 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@
2525
package com.sun.glass.ui.gtk;
2626

2727
import com.sun.glass.ui.Pixels;
28-
import java.nio.Buffer;
2928
import java.nio.ByteBuffer;
3029
import java.nio.IntBuffer;
3130

@@ -52,31 +51,21 @@ protected void _fillDirectByteBuffer(ByteBuffer bb) {
5251
// Taken from MacPixels
5352
if (this.bytes != null) {
5453
this.bytes.rewind();
55-
if (this.bytes.isDirect()) {
56-
_copyPixels(bb, this.bytes, getWidth()*getHeight());
57-
} else {
58-
bb.put(this.bytes);
59-
}
54+
bb.put(this.bytes);
6055
this.bytes.rewind();
6156
} else {
6257
this.ints.rewind();
63-
if (this.ints.isDirect()) {
64-
_copyPixels(bb, this.ints, getWidth()*getHeight());
65-
} else {
66-
for (int i=0; i<this.ints.capacity(); i++) {
67-
int data = this.ints.get();
68-
bb.put((byte)((data)&0xff));
69-
bb.put((byte)((data>>8)&0xff));
70-
bb.put((byte)((data>>16)&0xff));
71-
bb.put((byte)((data>>24)&0xff));
72-
}
58+
for (int i=0; i<this.ints.capacity(); i++) {
59+
int data = this.ints.get();
60+
bb.put((byte)((data)&0xff));
61+
bb.put((byte)((data>>8)&0xff));
62+
bb.put((byte)((data>>16)&0xff));
63+
bb.put((byte)((data>>24)&0xff));
7364
}
7465
this.ints.rewind();
7566
}
7667
}
7768

78-
protected native void _copyPixels(Buffer dst, Buffer src, int size);
79-
8069
@Override
8170
protected native void _attachInt(long ptr, int w, int h, IntBuffer ints, int[] array, int offset);
8271

‎modules/javafx.graphics/src/main/java/com/sun/glass/ui/mac/MacPixels.java

Lines changed: 8 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@
2424
*/
2525
package com.sun.glass.ui.mac;
2626

27-
import java.nio.Buffer;
2827
import java.nio.ByteBuffer;
2928
import java.nio.IntBuffer;
3029

@@ -69,29 +68,21 @@ protected MacPixels(int width, int height, IntBuffer data, float scalex, float s
6968
protected void _fillDirectByteBuffer(ByteBuffer bb) {
7069
if (this.bytes != null) {
7170
this.bytes.rewind();
72-
if (this.bytes.isDirect() == true) {
73-
_copyPixels(bb, this.bytes, getWidth()*getHeight());
74-
} else {
75-
bb.put(this.bytes);
76-
}
71+
bb.put(this.bytes);
7772
this.bytes.rewind();
7873
} else {
7974
this.ints.rewind();
80-
if (this.ints.isDirect() == true) {
81-
_copyPixels(bb, this.ints, getWidth()*getHeight());
82-
} else {
83-
for (int i=0; i<this.ints.capacity(); i++) {
84-
int data = this.ints.get();
85-
bb.put((byte)((data>>0)&0xff));
86-
bb.put((byte)((data>>8)&0xff));
87-
bb.put((byte)((data>>16)&0xff));
88-
bb.put((byte)((data>>24)&0xff));
89-
}
75+
for (int i=0; i<this.ints.capacity(); i++) {
76+
int data = this.ints.get();
77+
bb.put((byte)((data>>0)&0xff));
78+
bb.put((byte)((data>>8)&0xff));
79+
bb.put((byte)((data>>16)&0xff));
80+
bb.put((byte)((data>>24)&0xff));
9081
}
9182
this.ints.rewind();
9283
}
9384
}
94-
native protected void _copyPixels(Buffer src, Buffer dst, int size);
85+
9586
@Override native protected void _attachInt(long ptr, int w, int h, IntBuffer ints, int[] array, int offset);
9687
@Override native protected void _attachByte(long ptr, int w, int h, ByteBuffer bytes, byte[] array, int offset);
9788

‎modules/javafx.graphics/src/main/java/com/sun/glass/ui/mac/MacView.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -99,9 +99,9 @@ static int getMultiClickMaxY_impl() {
9999
pixels.getWidth(), pixels.getHeight(), pixels.getScaleX(), pixels.getScaleY());
100100
}
101101
}
102-
native void _uploadPixelsDirect(long viewPtr, Buffer pixels, int width, int height, float scaleX, float scaleY);
103-
native void _uploadPixelsByteArray(long viewPtr, byte[] pixels, int offset, int width, int height, float scaleX, float scaleY);
104-
native void _uploadPixelsIntArray(long viewPtr, int[] pixels, int offset, int width, int height, float scaleX, float scaleY);
102+
private native void _uploadPixelsDirect(long viewPtr, Buffer pixels, int width, int height, float scaleX, float scaleY);
103+
private native void _uploadPixelsByteArray(long viewPtr, byte[] pixels, int offset, int width, int height, float scaleX, float scaleY);
104+
private native void _uploadPixelsIntArray(long viewPtr, int[] pixels, int offset, int width, int height, float scaleX, float scaleY);
105105

106106
@Override
107107
protected void notifyResize(int width, int height) {

‎modules/javafx.graphics/src/main/native-font/directwrite.cpp

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2167,10 +2167,14 @@ JNIEXPORT jbyteArray JNICALL OS_NATIVE(CreateAlphaTexture)
21672167
/* In Only */
21682168
if (arg2) lparg2 = getRECTFields(env, arg2, &_arg2);
21692169
if (!lparg2) return NULL;
2170+
if (lparg2->right <= lparg2->left) return NULL;
2171+
if (lparg2->bottom <= lparg2->top) return NULL;
21702172
DWRITE_TEXTURE_TYPE textureType = (DWRITE_TEXTURE_TYPE)arg1;
21712173
UINT32 width = lparg2->right - lparg2->left;
21722174
UINT32 height = lparg2->bottom - lparg2->top;
21732175
UINT32 bpp = textureType == DWRITE_TEXTURE_CLEARTYPE_3x1 ? 3 : 1;
2176+
if (height > UINT32_MAX / bpp) return NULL;
2177+
if (height > 0 && width > UINT32_MAX / (height * bpp)) return NULL;
21742178
UINT32 bufferSize = width * height * bpp;
21752179
BYTE * buffer = new (std::nothrow) BYTE[bufferSize];
21762180
HRESULT hr = ((IDWriteGlyphRunAnalysis *)arg0)->CreateAlphaTexture(textureType, lparg2, buffer, bufferSize);
@@ -2233,6 +2237,10 @@ JNIEXPORT jint JNICALL OS_NATIVE(GetGlyphs)
22332237
if (arg15) if ((lparg15 = env->GetShortArrayElements(arg15, NULL)) == NULL) goto fail;
22342238
if (arg16) if ((lparg16 = env->GetShortArrayElements(arg16, NULL)) == NULL) goto fail;
22352239
if (arg17) if ((lparg17 = env->GetIntArrayElements(arg17, NULL)) == NULL) goto fail;
2240+
if (textStart < 0) goto fail;
2241+
if (!arg1) goto fail;
2242+
if (arg2 <= 0 || arg2 > env->GetArrayLength(arg1)) goto fail;
2243+
if (textStart > env->GetArrayLength(arg1) - arg2) goto fail;
22362244
const WCHAR* text = (const WCHAR*)(lparg1 + textStart);
22372245

22382246
hr = ((IDWriteTextAnalyzer *)arg0)->GetGlyphs(text,
@@ -2297,6 +2305,10 @@ JNIEXPORT jint JNICALL OS_NATIVE(GetGlyphPlacements)
22972305
if (arg15) if ((lparg15 = env->GetIntArrayElements(arg15, NULL)) == NULL) goto fail;
22982306
if (arg17) if ((lparg17 = env->GetFloatArrayElements(arg17, NULL)) == NULL) goto fail;
22992307
if (arg18) if ((lparg18 = env->GetFloatArrayElements(arg18, NULL)) == NULL) goto fail;
2308+
if (textStart < 0) goto fail;
2309+
if (!arg1) goto fail;
2310+
if (arg4 <= 0 || arg4 > env->GetArrayLength(arg1)) goto fail;
2311+
if (textStart > env->GetArrayLength(arg1) - arg4) goto fail;
23002312
const WCHAR* text = (const WCHAR*)(lparg1 + textStart);
23012313

23022314
hr = ((IDWriteTextAnalyzer *)arg0)->GetGlyphPlacements(text,

‎modules/javafx.graphics/src/main/native-glass/gtk/GlassPixels.cpp

Lines changed: 44 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -40,25 +40,6 @@ static void my_free(guchar *pixels, gpointer data) {
4040

4141
extern "C" {
4242

43-
/*
44-
* Class: com_sun_glass_ui_gtk_GtkPixels
45-
* Method: _copyPixels
46-
* Signature: (Ljava/nio/Buffer;Ljava/nio/Buffer;I)V
47-
*/
48-
JNIEXPORT void JNICALL Java_com_sun_glass_ui_gtk_GtkPixels__1copyPixels
49-
(JNIEnv *env, jobject obj, jobject jDst, jobject jSrc, jint jSize)
50-
{
51-
(void)obj;
52-
53-
//Taken from MacPixels (and fixed)
54-
void *src = env->GetDirectBufferAddress(jSrc);
55-
void *dst = env->GetDirectBufferAddress(jDst);
56-
if ((src != NULL) && (dst != NULL) && (jSize > 0))
57-
{
58-
memcpy(dst, src, jSize * 4);
59-
}
60-
}
61-
6243
/*
6344
* Class: com_sun_glass_ui_gtk_GtkPixels
6445
* Method: _attachInt
@@ -69,15 +50,35 @@ JNIEXPORT void JNICALL Java_com_sun_glass_ui_gtk_GtkPixels__1attachInt
6950
{
7051
(void)obj;
7152

53+
if (!ptr) return;
54+
if (!array && !ints) return;
55+
if (offset < 0) return;
56+
if (w <= 0 || h <= 0) return;
57+
58+
if (w > (((INT_MAX - offset) / 4) / h))
59+
{
60+
return;
61+
}
62+
7263
jint *data;
7364
GdkPixbuf **pixbuf;
7465
guint8 *dataRGBA;
7566

67+
jsize numElem;
68+
if (array == NULL) {
69+
numElem = env->GetDirectBufferCapacity(ints);
70+
} else {
71+
numElem = env->GetArrayLength(array);
72+
}
73+
74+
if ((w * h + offset) > numElem)
75+
{
76+
return;
77+
}
78+
7679
if (array == NULL) {
7780
data = (jint*) env->GetDirectBufferAddress(ints);
78-
assert((w*h*4 + offset * 4) == env->GetDirectBufferCapacity(ints));
7981
} else {
80-
assert((w*h + offset) == env->GetArrayLength(array));
8182
data = (jint*) env->GetPrimitiveArrayCritical(array, 0);
8283
}
8384

@@ -101,15 +102,35 @@ JNIEXPORT void JNICALL Java_com_sun_glass_ui_gtk_GtkPixels__1attachByte
101102
{
102103
(void)obj;
103104

105+
if (!ptr) return;
106+
if (!array && !bytes) return;
107+
if (offset < 0) return;
108+
if (w <= 0 || h <= 0) return;
109+
110+
if (w > (((INT_MAX - offset) / 4) / h))
111+
{
112+
return;
113+
}
114+
104115
jbyte *data;
105116
GdkPixbuf **pixbuf;
106117
guint8 *dataRGBA;
107118

119+
jsize numElem;
120+
if (array == NULL) {
121+
numElem = env->GetDirectBufferCapacity(bytes);
122+
} else {
123+
numElem = env->GetArrayLength(array);
124+
}
125+
126+
if ((w * h * 4 + offset) > numElem)
127+
{
128+
return;
129+
}
130+
108131
if (array == NULL) {
109132
data = (jbyte*) env->GetDirectBufferAddress(bytes);
110-
assert((w*h*4 + offset) == env->GetDirectBufferCapacity(bytes));
111133
} else {
112-
assert((w*h*4 + offset) == env->GetArrayLength(array));
113134
data = (jbyte*) env->GetPrimitiveArrayCritical(array, 0);
114135
}
115136

‎modules/javafx.graphics/src/main/native-glass/gtk/GlassView.cpp

Lines changed: 33 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,9 @@ JNIEXPORT void JNICALL Java_com_sun_glass_ui_gtk_GtkView__1uploadPixelsDirect
185185
{
186186
(void)jView;
187187

188+
if (!ptr) return;
189+
if (!buffer) return;
190+
188191
GlassView* view = JLONG_TO_GLASSVIEW(ptr);
189192
if (view->current_window) {
190193
void *data = env->GetDirectBufferAddress(buffer);
@@ -203,10 +206,24 @@ JNIEXPORT void JNICALL Java_com_sun_glass_ui_gtk_GtkView__1uploadPixelsIntArray
203206
{
204207
(void)obj;
205208

209+
if (!ptr) return;
210+
if (!array) return;
211+
if (offset < 0) return;
212+
if (width <= 0 || height <= 0) return;
213+
214+
if (width > ((INT_MAX - offset) / height))
215+
{
216+
return;
217+
}
218+
219+
if ((width * height + offset) > env->GetArrayLength(array))
220+
{
221+
return;
222+
}
223+
206224
GlassView* view = JLONG_TO_GLASSVIEW(ptr);
207225
if (view->current_window) {
208226
int *data = NULL;
209-
assert((width*height + offset) == env->GetArrayLength(array));
210227
data = (int*)env->GetPrimitiveArrayCritical(array, 0);
211228

212229
view->current_window->paint(data + offset, width, height);
@@ -225,11 +242,25 @@ JNIEXPORT void JNICALL Java_com_sun_glass_ui_gtk_GtkView__1uploadPixelsByteArray
225242
{
226243
(void)obj;
227244

245+
if (!ptr) return;
246+
if (!array) return;
247+
if (offset < 0) return;
248+
if (width <= 0 || height <= 0) return;
249+
250+
if (width > (((INT_MAX - offset) / 4) / height))
251+
{
252+
return;
253+
}
254+
255+
if ((4 * width * height + offset) > env->GetArrayLength(array))
256+
{
257+
return;
258+
}
259+
228260
GlassView* view = JLONG_TO_GLASSVIEW(ptr);
229261
if (view->current_window) {
230262
unsigned char *data = NULL;
231263

232-
assert((4*width*height + offset) == env->GetArrayLength(array));
233264
data = (unsigned char*)env->GetPrimitiveArrayCritical(array, 0);
234265

235266
view->current_window->paint(data + offset, width, height);

0 commit comments

Comments
 (0)