Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
openanolis
dragonwell8_jdk
提交
47e3bc91
D
dragonwell8_jdk
项目概览
openanolis
/
dragonwell8_jdk
通知
4
Star
2
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
D
dragonwell8_jdk
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
提交
47e3bc91
编写于
7月 20, 2011
作者:
A
asaha
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
7023640: calculation for malloc size in TransformHelper.c could overflow an integer
Reviewed-by: flar
上级
9114f73f
变更
1
隐藏空白更改
内联
并排
Showing
1 changed file
with
41 addition
and
16 deletion
+41
-16
src/share/native/sun/java2d/loops/TransformHelper.c
src/share/native/sun/java2d/loops/TransformHelper.c
+41
-16
未找到文件。
src/share/native/sun/java2d/loops/TransformHelper.c
浏览文件 @
47e3bc91
/*
/*
* Copyright (c) 2004, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2004,
2011,
Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
*
* This code is free software; you can redistribute it and/or modify it
* This code is free software; you can redistribute it and/or modify it
...
@@ -284,7 +284,7 @@ Java_sun_java2d_loops_TransformHelper_Transform
...
@@ -284,7 +284,7 @@ Java_sun_java2d_loops_TransformHelper_Transform
TransformHelperFunc
*
pHelperFunc
;
TransformHelperFunc
*
pHelperFunc
;
TransformInterpFunc
*
pInterpFunc
;
TransformInterpFunc
*
pInterpFunc
;
jdouble
xorig
,
yorig
;
jdouble
xorig
,
yorig
;
j
int
numedges
;
j
long
numedges
;
jint
*
pEdges
;
jint
*
pEdges
;
jint
edgebuf
[
2
+
MAXEDGES
*
2
];
jint
edgebuf
[
2
+
MAXEDGES
*
2
];
union
{
union
{
...
@@ -379,19 +379,44 @@ Java_sun_java2d_loops_TransformHelper_Transform
...
@@ -379,19 +379,44 @@ Java_sun_java2d_loops_TransformHelper_Transform
}
}
Region_IntersectBounds
(
&
clipInfo
,
&
dstInfo
.
bounds
);
Region_IntersectBounds
(
&
clipInfo
,
&
dstInfo
.
bounds
);
numedges
=
(
dstInfo
.
bounds
.
y2
-
dstInfo
.
bounds
.
y1
);
numedges
=
(((
jlong
)
dstInfo
.
bounds
.
y2
)
-
((
jlong
)
dstInfo
.
bounds
.
y1
));
if
(
numedges
>
MAXEDGES
)
{
if
(
numedges
<=
0
)
{
pEdges
=
malloc
((
2
+
2
*
numedges
)
*
sizeof
(
*
pEdges
));
pEdges
=
NULL
;
if
(
pEdges
==
NULL
)
{
}
else
if
(
!
JNU_IsNull
(
env
,
edgeArray
))
{
SurfaceData_InvokeUnlock
(
env
,
dstOps
,
&
dstInfo
);
/*
SurfaceData_InvokeUnlock
(
env
,
srcOps
,
&
srcInfo
);
* Ideally Java should allocate an array large enough, but if
/* edgeArray should already contain zeros for min/maxy */
* we ever have a miscommunication about the number of edge
return
;
* lines, or if the Java array calculation should overflow to
}
* a positive number and succeed in allocating an array that
* is too small, we need to verify that it can still hold the
* number of integers that we plan to store to be safe.
*/
jsize
edgesize
=
(
*
env
)
->
GetArrayLength
(
env
,
edgeArray
);
/* (edgesize/2 - 1) should avoid any overflow or underflow. */
pEdges
=
(((
edgesize
/
2
)
-
1
)
>=
numedges
)
?
(
*
env
)
->
GetPrimitiveArrayCritical
(
env
,
edgeArray
,
NULL
)
:
NULL
;
}
else
if
(
numedges
>
MAXEDGES
)
{
/* numedges variable (jlong) can be at most ((1<<32)-1) */
/* memsize can overflow a jint, but not a jlong */
jlong
memsize
=
((
numedges
*
2
)
+
2
)
*
sizeof
(
*
pEdges
);
pEdges
=
(
memsize
==
((
size_t
)
memsize
))
?
malloc
((
size_t
)
memsize
)
:
NULL
;
}
else
{
}
else
{
pEdges
=
edgebuf
;
pEdges
=
edgebuf
;
}
}
if
(
pEdges
==
NULL
)
{
if
(
numedges
>
0
)
{
JNU_ThrowInternalError
(
env
,
"Unable to allocate edge list"
);
}
SurfaceData_InvokeUnlock
(
env
,
dstOps
,
&
dstInfo
);
SurfaceData_InvokeUnlock
(
env
,
srcOps
,
&
srcInfo
);
/* edgeArray should already contain zeros for min/maxy */
return
;
}
Transform_GetInfo
(
env
,
itxform
,
&
itxInfo
);
Transform_GetInfo
(
env
,
itxform
,
&
itxInfo
);
if
(
!
Region_IsEmpty
(
&
clipInfo
))
{
if
(
!
Region_IsEmpty
(
&
clipInfo
))
{
...
@@ -500,14 +525,14 @@ Java_sun_java2d_loops_TransformHelper_Transform
...
@@ -500,14 +525,14 @@ Java_sun_java2d_loops_TransformHelper_Transform
}
else
{
}
else
{
pEdges
[
0
]
=
pEdges
[
1
]
=
0
;
pEdges
[
0
]
=
pEdges
[
1
]
=
0
;
}
}
SurfaceData_InvokeUnlock
(
env
,
dstOps
,
&
dstInfo
);
SurfaceData_InvokeUnlock
(
env
,
srcOps
,
&
srcInfo
);
if
(
!
JNU_IsNull
(
env
,
edgeArray
))
{
if
(
!
JNU_IsNull
(
env
,
edgeArray
))
{
(
*
env
)
->
SetIntArrayRegion
(
env
,
edgeArray
,
0
,
2
+
numedges
*
2
,
pEdges
);
(
*
env
)
->
ReleasePrimitiveArrayCritical
(
env
,
edgeArray
,
pEdges
,
0
);
}
}
else
if
(
pEdges
!=
edgebuf
)
{
if
(
pEdges
!=
edgebuf
)
{
free
(
pEdges
);
free
(
pEdges
);
}
}
SurfaceData_InvokeUnlock
(
env
,
dstOps
,
&
dstInfo
);
SurfaceData_InvokeUnlock
(
env
,
srcOps
,
&
srcInfo
);
}
}
static
void
static
void
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录