Commit message: None
CVE: CVE-2011-3906
CWE: CWE-119
Vulnerability description: The PDF parser in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

Project: Chrome

TextAutosizer::TextAutosizer(Document* document)
    : m_document(document)
{
}

Project: Chrome

bool TextAutosizer::clusterShouldBeAutosized(const RenderBlock* lowestCommonAncestor, float commonAncestorWidth)
{
    const float minLinesOfText = 4;
    float minTextWidth = commonAncestorWidth * minLinesOfText;
    float textWidth = 0;
    measureDescendantTextWidth(lowestCommonAncestor, minTextWidth, textWidth);
    if (textWidth >= minTextWidth)
        return true;
    return false;
}

Project: Chrome

float TextAutosizer::computeAutosizedFontSize(float specifiedSize, float multiplier)
{
    const float pleasantSize = 16;

    const float gradientAfterPleasantSize = 0.5;

    float computedSize;
    if (specifiedSize <= pleasantSize)
        computedSize = multiplier * specifiedSize;
    else {
        computedSize = multiplier * pleasantSize + gradientAfterPleasantSize * (specifiedSize - pleasantSize);
        if (computedSize < specifiedSize)
            computedSize = specifiedSize;
    }
    return computedSize;
}

Project: Chrome

bool TextAutosizer::isAutosizingCluster(const RenderBlock* renderer)
{
    ASSERT(isAutosizingContainer(renderer));

    return renderer->isRenderView()
        || renderer->isFloating()
        || renderer->isOutOfFlowPositioned()
        || renderer->isTableCell()
        || renderer->isTableCaption()
        || renderer->isFlexibleBoxIncludingDeprecated()
        || renderer->hasColumns()
        || renderer->style()->overflowX() != OVISIBLE
        || renderer->style()->overflowY() != OVISIBLE
        || renderer->containingBlock()->isHorizontalWritingMode() != renderer->isHorizontalWritingMode();
}

Project: Chrome

bool TextAutosizer::isAutosizingContainer(const RenderObject* renderer)
{
    return renderer->isRenderBlock() && !renderer->isInline() && !renderer->isListItem();
}

Project: Chrome

RenderObject* TextAutosizer::nextInPreOrderSkippingDescendantsOfContainers(const RenderObject* current, const RenderObject* stayWithin)
{
    if (current == stayWithin || !isAutosizingContainer(current))
        for (RenderObject* child = current->firstChild(); child; child = child->nextSibling())
            return child;

    for (const RenderObject* ancestor = current; ancestor; ancestor = ancestor->parent()) {
        if (ancestor == stayWithin)
            return 0;
        for (RenderObject* sibling = ancestor->nextSibling(); sibling; sibling = sibling->nextSibling())
            return sibling;
    }

    return 0;
}

Project: Chrome

void TextAutosizer::processContainer(float multiplier, RenderBlock* container, RenderObject* subtreeRoot, const TextAutosizingWindowInfo& windowInfo)
{
    ASSERT(isAutosizingContainer(container));

    float localMultiplier = contentHeightIsConstrained(container) ? 1 : multiplier;

    RenderObject* descendant = nextInPreOrderSkippingDescendantsOfContainers(subtreeRoot, subtreeRoot);
    while (descendant) {
        if (descendant->isText()) {
            if (localMultiplier != descendant->style()->textAutosizingMultiplier()) {
                setMultiplier(descendant, localMultiplier);
                setMultiplier(descendant->parent(), localMultiplier); // Parent does line spacing.
            }
        } else if (isAutosizingContainer(descendant)) {
            RenderBlock* descendantBlock = toRenderBlock(descendant);
            if (isAutosizingCluster(descendantBlock))
                processCluster(descendantBlock, descendantBlock, descendantBlock, windowInfo);
            else
                processContainer(multiplier, descendantBlock, descendantBlock, windowInfo);
        }
        descendant = nextInPreOrderSkippingDescendantsOfContainers(descendant, subtreeRoot);
    }
}

Project: Chrome

void TextAutosizer::setMultiplier(RenderObject* renderer, float multiplier)
{
    RefPtr<RenderStyle> newStyle = RenderStyle::clone(renderer->style());
    newStyle->setTextAutosizingMultiplier(multiplier);
    renderer->setStyle(newStyle.release());
}