Commit message: None
CVE: CVE-2012-5143
CWE: CWE-190
Vulnerability description: Integer overflow in Google Chrome before 23.0.1271.97 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to PPAPI image buffers.

Project: Chrome

PPB_ImageData_API* PPB_ImageData_Impl::AsPPB_ImageData_API() {
  return this;
}

Project: Chrome

PP_Resource PPB_ImageData_Impl::CreateNaCl(PP_Instance instance,
                                               PP_ImageDataFormat format,
                                               const PP_Size& size,
                                               PP_Bool init_to_zero) {
  scoped_refptr<PPB_ImageData_Impl>
      data(new PPB_ImageData_Impl(instance, NACL));
  if (!data->Init(format, size.width, size.height, !!init_to_zero))
    return 0;
  return data->GetReference();
}

Project: Chrome

PP_Resource PPB_ImageData_Impl::CreatePlatform(PP_Instance instance,
                                               PP_ImageDataFormat format,
                                               const PP_Size& size,
                                               PP_Bool init_to_zero) {
  scoped_refptr<PPB_ImageData_Impl>
      data(new PPB_ImageData_Impl(instance, PLATFORM));
  if (!data->Init(format, size.width, size.height, !!init_to_zero))
    return 0;
  return data->GetReference();
}

Project: Chrome

PP_Bool PPB_ImageData_Impl::Describe(PP_ImageDataDesc* desc) {
  desc->format = format_;
  desc->size.width = width_;
  desc->size.height = height_;
  desc->stride = width_ * 4;
  return PP_TRUE;
}

Project: Chrome

SkCanvas* PPB_ImageData_Impl::GetCanvas() {
  return backend_->GetCanvas();
}

Project: Chrome

SkCanvas* ImageDataPlatformBackend::GetCanvas() {
  return mapped_canvas_.get();
}

Project: Chrome

const SkBitmap* PPB_ImageData_Impl::GetMappedBitmap() const {
  return backend_->GetMappedBitmap();
}

Project: Chrome

const SkBitmap* ImageDataPlatformBackend::GetMappedBitmap() const {
  if (!mapped_canvas_.get())
    return NULL;
  return &skia::GetTopDevice(*mapped_canvas_)->accessBitmap(false);
}

Project: Chrome

const SkBitmap* ImageDataNaClBackend::GetMappedBitmap() const {
  if (!IsMapped())
    return NULL;
  return &skia_bitmap_;
}

Project: Chrome

skia::PlatformCanvas* PPB_ImageData_Impl::GetPlatformCanvas() {
  return backend_->GetPlatformCanvas();
}

Project: Chrome

skia::PlatformCanvas* ImageDataPlatformBackend::GetPlatformCanvas() {
  return mapped_canvas_.get();
}

Project: Chrome

skia::PlatformCanvas* ImageDataNaClBackend::GetPlatformCanvas() {
  return NULL;
}

Project: Chrome

int32_t PPB_ImageData_Impl::GetSharedMemory(int* handle, uint32_t* byte_count) {
  return backend_->GetSharedMemory(handle, byte_count);
}

Project: Chrome

int32_t ImageDataPlatformBackend::GetSharedMemory(int* handle,
                                                   uint32_t* byte_count) {
  *handle = platform_image_->GetSharedMemoryHandle(byte_count);
  return PP_OK;
}

Project: Chrome

ImageDataNaClBackend::ImageDataNaClBackend()
    : map_count_(0) {
}

Project: Chrome

ImageDataPlatformBackend::ImageDataPlatformBackend() {
}

Project: Chrome

bool ImageDataPlatformBackend::Init(PPB_ImageData_Impl* impl,
                                     PP_ImageDataFormat format,
                                     int width, int height,
                                     bool init_to_zero) {
  PluginDelegate* plugin_delegate = ResourceHelper::GetPluginDelegate(impl);
  if (!plugin_delegate)
    return false;

  platform_image_.reset(plugin_delegate->CreateImage2D(width, height));
  return !!platform_image_.get();
}

Project: Chrome

bool ImageDataNaClBackend::Init(PPB_ImageData_Impl* impl,
                                 PP_ImageDataFormat format,
                                 int width, int height,
                                 bool init_to_zero) {
  skia_bitmap_.setConfig(SkBitmap::kARGB_8888_Config,
                         impl->width(), impl->height());
  PluginDelegate* plugin_delegate = ResourceHelper::GetPluginDelegate(impl);
  if (!plugin_delegate)
    return false;
  shared_memory_.reset(
      plugin_delegate->CreateAnonymousSharedMemory(skia_bitmap_.getSize()));
  return !!shared_memory_.get();
}

Project: Chrome

bool PPB_ImageData_Impl::IsMapped() const {
  return backend_->IsMapped();
}

Project: Chrome

bool ImageDataPlatformBackend::IsMapped() const {
  return !!mapped_canvas_.get();
}

Project: Chrome

bool ImageDataNaClBackend::IsMapped() const {
  return map_count_ > 0;
}

Project: Chrome

void* PPB_ImageData_Impl::Map() {
  return backend_->Map();
}

Project: Chrome

void* ImageDataPlatformBackend::Map() {
  if (!mapped_canvas_.get()) {
    mapped_canvas_.reset(platform_image_->Map());
    if (!mapped_canvas_.get())
      return NULL;
  }
  const SkBitmap& bitmap =
      skia::GetTopDevice(*mapped_canvas_)->accessBitmap(true);

  const_cast<SkBitmap&>(bitmap).setIsOpaque(false);

  bitmap.lockPixels();
  return bitmap.getAddr32(0, 0);
}

Project: Chrome

PluginDelegate::PlatformImage2D* PPB_ImageData_Impl::PlatformImage() const {
  return backend_->PlatformImage();
}

Project: Chrome

ImageDataPlatformBackend::PlatformImage() const {
  return platform_image_.get();
}

Project: Chrome

PluginDelegate::PlatformImage2D* ImageDataNaClBackend::PlatformImage() const {
  return NULL;
}

Project: Chrome

void ImageDataPlatformBackend::Unmap() {
}

Project: Chrome

ImageDataNaClBackend::~ImageDataNaClBackend() {
}

Project: Chrome

ImageDataPlatformBackend::~ImageDataPlatformBackend() {
}

Project: Chrome

PPB_ImageData_Impl::~PPB_ImageData_Impl() {
}