Commit message: None
CVE: CVE-2011-3114
CWE: CWE-119
Vulnerability description: Multiple buffer overflows in the PDF functionality in Google Chrome before 19.0.1084.52 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger unknown function calls.

Project: Chrome

BrowserNonClientFrameViewAura::BrowserNonClientFrameViewAura(
    BrowserFrame* frame, BrowserView* browser_view)
    : BrowserNonClientFrameView(frame, browser_view),
      maximize_button_(NULL),
      close_button_(NULL),
      window_icon_(NULL),
      frame_painter_(new ash::FramePainter) {
}

Project: Chrome

gfx::Rect BrowserNonClientFrameViewAura::GetBoundsForClientView() const {
  int top_height = NonClientTopBorderHeight(false);
  return frame_painter_->GetBoundsForClientView(top_height, bounds());
}

Project: Chrome

gfx::Rect BrowserNonClientFrameViewAura::GetBoundsForTabStrip(
    views::View* tabstrip) const {
  if (!tabstrip)
    return gfx::Rect();
  int tabstrip_x =
      avatar_button() ?
      (avatar_button()->bounds().right() + kAvatarSideSpacing) :
      kTabstripLeftSpacing;
  int tabstrip_width =
      maximize_button_->x() - kTabstripRightSpacing - tabstrip_x;
  return gfx::Rect(tabstrip_x,
                   GetHorizontalTabStripVerticalOffset(false),
                   std::max(0, tabstrip_width),
                   tabstrip->GetPreferredSize().height());
}

Project: Chrome

SkBitmap* BrowserNonClientFrameViewAura::GetCustomBitmap(
    int bitmap_id,
    int fallback_bitmap_id) const {
  ui::ThemeProvider* tp = GetThemeProvider();
  if (tp->HasCustomImage(bitmap_id))
    return tp->GetBitmapNamed(bitmap_id);
  return tp->GetBitmapNamed(fallback_bitmap_id);
}

Project: Chrome

SkBitmap BrowserNonClientFrameViewAura::GetFaviconForTabIconView() {
  views::WidgetDelegate* delegate = frame()->widget_delegate();
  if (!delegate)
    return SkBitmap();
  return delegate->GetWindowIcon();
}

Project: Chrome

int BrowserNonClientFrameViewAura::GetHorizontalTabStripVerticalOffset(
    bool force_restored) const {
  return NonClientTopBorderHeight(force_restored);
}

Project: Chrome

gfx::Size BrowserNonClientFrameViewAura::GetMinimumSize() {
  return frame_painter_->GetMinimumSize(this);
}

Project: Chrome

const SkBitmap* BrowserNonClientFrameViewAura::GetThemeFrameBitmap() const {
  bool is_incognito = browser_view()->IsOffTheRecord();
  int resource_id;
  if (browser_view()->IsBrowserTypeNormal()) {
    if (ShouldPaintAsActive()) {
      if (is_incognito) {
        return GetCustomBitmap(IDR_THEME_FRAME_INCOGNITO,
                               IDR_AURA_WINDOW_HEADER_BASE_INCOGNITO_ACTIVE);
      }
      return GetCustomBitmap(IDR_THEME_FRAME,
                             IDR_AURA_WINDOW_HEADER_BASE_ACTIVE);
    }
    if (is_incognito) {
      return GetCustomBitmap(IDR_THEME_FRAME_INCOGNITO_INACTIVE,
                             IDR_AURA_WINDOW_HEADER_BASE_INCOGNITO_INACTIVE);
    }
    return GetCustomBitmap(IDR_THEME_FRAME_INACTIVE,
                           IDR_AURA_WINDOW_HEADER_BASE_INACTIVE);
  }
  ui::ResourceBundle& rb = ui::ResourceBundle::GetSharedInstance();
  if (ShouldPaintAsActive()) {
    resource_id = is_incognito ?
        IDR_AURA_WINDOW_HEADER_BASE_INCOGNITO_ACTIVE :
        IDR_AURA_WINDOW_HEADER_BASE_ACTIVE;
  } else {
    resource_id = is_incognito ?
        IDR_AURA_WINDOW_HEADER_BASE_INCOGNITO_INACTIVE :
        IDR_AURA_WINDOW_HEADER_BASE_INACTIVE;
  }
  return rb.GetBitmapNamed(resource_id);
}

Project: Chrome

BrowserNonClientFrameViewAura::GetThemeFrameOverlayBitmap() const {
  ui::ThemeProvider* tp = GetThemeProvider();
  if (tp->HasCustomImage(IDR_THEME_FRAME_OVERLAY) &&
      browser_view()->IsBrowserTypeNormal() &&
      !browser_view()->IsOffTheRecord()) {
    return tp->GetBitmapNamed(ShouldPaintAsActive() ?
        IDR_THEME_FRAME_OVERLAY : IDR_THEME_FRAME_OVERLAY_INACTIVE);
  }
  return NULL;
}

Project: Chrome

gfx::Rect BrowserNonClientFrameViewAura::GetWindowBoundsForClientBounds(
    const gfx::Rect& client_bounds) const {
  int top_height = NonClientTopBorderHeight(false);
  return frame_painter_->GetWindowBoundsForClientBounds(top_height,
                                                        client_bounds);
}

Project: Chrome

void BrowserNonClientFrameViewAura::GetWindowMask(const gfx::Size& size,
                                                  gfx::Path* window_mask) {
}

Project: Chrome

bool BrowserNonClientFrameViewAura::HitTest(const gfx::Point& l) const {
  if (NonClientFrameView::HitTest(l))
    return true;

  if (!browser_view()->tabstrip())
    return false;
  gfx::Rect tabstrip_bounds(browser_view()->tabstrip()->bounds());
  gfx::Point tabstrip_origin(tabstrip_bounds.origin());
  View::ConvertPointToView(frame()->client_view(), this, &tabstrip_origin);
  tabstrip_bounds.set_origin(tabstrip_origin);
  if (l.y() > tabstrip_bounds.bottom())
    return false;

  gfx::Point browser_view_point(l);
  View::ConvertPointToView(parent(), browser_view(), &browser_view_point);
  return browser_view()->IsPositionInWindowCaption(browser_view_point);
}

Project: Chrome

void BrowserNonClientFrameViewAura::Init() {
  maximize_button_ = new ash::FrameMaximizeButton(this, this);
  maximize_button_->SetAccessibleName(
      l10n_util::GetStringUTF16(IDS_ACCNAME_MAXIMIZE));
  AddChildView(maximize_button_);
  close_button_ = new views::ImageButton(this);
  close_button_->SetAccessibleName(
      l10n_util::GetStringUTF16(IDS_ACCNAME_CLOSE));
  AddChildView(close_button_);

  if (browser_view()->ShouldShowWindowIcon()) {
    window_icon_ = new TabIconView(this);
    window_icon_->set_is_light(true);
    AddChildView(window_icon_);
    window_icon_->Update();
  }

  UpdateAvatarInfo();

  frame_painter_->Init(frame(), window_icon_, maximize_button_, close_button_);
}

Project: Chrome

void BrowserNonClientFrameViewAura::Layout() {
  bool maximized_layout =
      frame()->IsMaximized() || !browser_view()->IsBrowserTypeNormal();
  frame_painter_->LayoutHeader(this, maximized_layout);
  if (avatar_button())
    LayoutAvatar();
  BrowserNonClientFrameView::Layout();
}

Project: Chrome

 void BrowserNonClientFrameViewAura::LayoutAvatar() {
  DCHECK(avatar_button());
  SkBitmap incognito_icon = browser_view()->GetOTRAvatarIcon();

  int avatar_bottom = GetHorizontalTabStripVerticalOffset(false) +
      browser_view()->GetTabStripHeight() - kAvatarBottomSpacing;
  int avatar_restored_y = avatar_bottom - incognito_icon.height();
  int avatar_y = frame()->IsMaximized() ?
      NonClientTopBorderHeight(false) + kTabShadowHeight:
      avatar_restored_y;
  gfx::Rect avatar_bounds(kAvatarSideSpacing,
                          avatar_y,
                          incognito_icon.width(),
                          avatar_bottom - avatar_y);
  avatar_button()->SetBoundsRect(avatar_bounds);
}

Project: Chrome

int BrowserNonClientFrameViewAura::NonClientHitTest(const gfx::Point& point) {
  return frame_painter_->NonClientHitTest(this, point);
}

Project: Chrome

void BrowserNonClientFrameViewAura::OnPaint(gfx::Canvas* canvas) {
  if (frame()->IsFullscreen())
    return;  // Nothing visible, don't paint.
  frame_painter_->PaintHeader(this,
                              canvas,
                              GetThemeFrameBitmap(),
                              GetThemeFrameOverlayBitmap());
  frame_painter_->PaintTitleBar(this, canvas, BrowserFrame::GetTitleFont());
  if (browser_view()->IsToolbarVisible())
    PaintToolbarBackground(canvas);
}

Project: Chrome

void BrowserNonClientFrameViewAura::PaintToolbarBackground(
    gfx::Canvas* canvas) {
  gfx::Rect toolbar_bounds(browser_view()->GetToolbarBounds());
  if (toolbar_bounds.IsEmpty())
    return;
  gfx::Point toolbar_origin(toolbar_bounds.origin());
  ConvertPointToView(browser_view(), this, &toolbar_origin);
  toolbar_bounds.set_origin(toolbar_origin);

  int x = toolbar_bounds.x();
  int w = toolbar_bounds.width();
  int y = toolbar_bounds.y();
  int h = toolbar_bounds.height();

  int split_point = kFrameShadowThickness * 2;
  int bottom_y = y + split_point;
  ui::ThemeProvider* tp = GetThemeProvider();
  SkBitmap* theme_toolbar = tp->GetBitmapNamed(IDR_THEME_TOOLBAR);
  int bottom_edge_height = std::min(theme_toolbar->height(), h) - split_point;

  canvas->FillRect(gfx::Rect(x, bottom_y, w, bottom_edge_height),
                   tp->GetColor(ThemeService::COLOR_TOOLBAR));

  bool restored = !frame()->IsMaximized();
  canvas->TileImageInt(
      *theme_toolbar,
      x, bottom_y - GetHorizontalTabStripVerticalOffset(restored),
      x, bottom_y,
      w, theme_toolbar->height());

  SkBitmap* toolbar_center =
      tp->GetBitmapNamed(IDR_CONTENT_TOP_CENTER);
  canvas->TileImageInt(*toolbar_center,
                       0, 0,
                       x, y,
                       w, split_point);

  canvas->FillRect(gfx::Rect(x + kClientEdgeThickness,
                             toolbar_bounds.bottom() - kClientEdgeThickness,
                             w - (2 * kClientEdgeThickness),
                             kClientEdgeThickness),
      ThemeService::GetDefaultColor(ThemeService::COLOR_TOOLBAR_SEPARATOR));
}

Project: Chrome

bool BrowserNonClientFrameViewAura::ShouldTabIconViewAnimate() const {
  content::WebContents* current_tab = browser_view()->GetSelectedWebContents();
  return current_tab ? current_tab->IsLoading() : false;
}

Project: Chrome

void BrowserNonClientFrameViewAura::UpdateThrobber(bool running) {
  if (window_icon_)
    window_icon_->Update();
}

Project: Chrome

BrowserNonClientFrameViewAura::~BrowserNonClientFrameViewAura() {
}