8289336: Better platform image support

8289343: Better GL support Reviewed-by: prr, mschoene, rhalade, kcr
openjdk · Jan 17, 2023 · 993ef95 · 993ef95
1 parent 36f8bde
commit 993ef95
Show file tree

Hide file tree

Showing 6 changed files with 93 additions and 10 deletions.
diff --git a/modules/javafx.graphics/src/main/java/com/sun/javafx/iio/bmp/BMPImageLoaderFactory.java b/modules/javafx.graphics/src/main/java/com/sun/javafx/iio/bmp/BMPImageLoaderFactory.java
@@ -121,6 +121,16 @@ final class BitmapInfoHeader {
                 throw new IOException("BitmapInfoHeader is corrupt");
             }
         }
+        if (biWidth <= 0) {
+            throw new IOException("Bad BMP image width, must be > 0!");
+        }
+        if (biHeight <= 0) {
+            throw new IOException("Bad BMP image height, must be > 0!");
+        }
+        if (biWidth >= (Integer.MAX_VALUE / biHeight)) {
+            throw new IOException("Bad BMP image size!");
+        }
+
         validate();
     }
 
@@ -472,22 +482,24 @@ public ImageFrame load(int imageIndex, int width, int height,
         if (0 != imageIndex) {
             return null;
         }
-
         int hght = Math.abs(bih.biHeight);
 
         int[] outWH = ImageTools.computeDimensions(bih.biWidth, hght, width, height, preserveAspectRatio);
         width = outWH[0];
         height = outWH[1];
 
+        int bpp = 3;
+        if (width >= (Integer.MAX_VALUE / height / bpp)) {
+            throw new IOException("Bad BMP image size!");
+        }
+
         // Pass image metadata to any listeners.
         ImageMetadata imageMetadata = new ImageMetadata(null, Boolean.TRUE,
             null, null, null, null, null, width, height,
             null, null, null);
         updateImageMetadata(imageMetadata);
 
-        int bpp = 3;
         int stride = bih.biWidth * bpp;
-
         byte image[] = new byte[stride * hght];
 
         switch (bih.biBitCount) {

diff --git a/modules/javafx.graphics/src/main/java/com/sun/javafx/iio/common/ImageTools.java b/modules/javafx.graphics/src/main/java/com/sun/javafx/iio/common/ImageTools.java
@@ -682,10 +682,10 @@ public static int[] computeDimensions(int sourceWidth, int sourceHeight,
 
 
             // clamp dimensions to positive values
-            if (finalWidth == 0) {
+            if (finalWidth <= 0) {
                 finalWidth = 1;
             }
-            if (finalHeight == 0) {
+            if (finalHeight <= 0) {
                 finalHeight = 1;
             }
         }

diff --git a/modules/javafx.graphics/src/main/java/com/sun/javafx/iio/png/PNGImageLoader2.java b/modules/javafx.graphics/src/main/java/com/sun/javafx/iio/png/PNGImageLoader2.java
@@ -96,7 +96,13 @@ private void readHeader() throws IOException {
         width = stream.readInt();
         height = stream.readInt();
 
-        if (width == 0 || height == 0) {
+        if (width <= 0) {
+            throw new IOException("Bad PNG image width, must be > 0!");
+        }
+        if (height <= 0) {
+            throw new IOException("Bad PNG image height, must be > 0!");
+        }
+        if (width >= (Integer.MAX_VALUE / height)) {
             throw new IOException("Bad PNG image size!");
         }
 
@@ -583,8 +589,11 @@ private void load(byte image[], InputStream data) throws IOException {
         }
     }
 
-    private ImageFrame decodePalette(byte srcImage[], ImageMetadata metadata) {
+    private ImageFrame decodePalette(byte srcImage[], ImageMetadata metadata) throws IOException {
         int bpp = tRNS_present ? 4 : 3;
+        if (width >= (Integer.MAX_VALUE / height / bpp)) {
+            throw new IOException("Bad PNG image size!");
+        }
         byte newImage[] = new byte[width * height * bpp];
         int l = width * height;
 
@@ -640,6 +649,11 @@ public ImageFrame load(int imageIndex, int rWidth, int rHeight,
             return null;
         }
 
+        int bpp = bpp();
+        if (width >= (Integer.MAX_VALUE / height / bpp)) {
+            throw new IOException("Bad PNG image size!");
+        }
+
         int[] outWH = ImageTools.computeDimensions(width, height, rWidth, rHeight, preserveAspectRatio);
         rWidth = outWH[0];
         rHeight = outWH[1];
@@ -648,7 +662,6 @@ public ImageFrame load(int imageIndex, int rWidth, int rHeight,
                 null, null, null, null, null, rWidth, rHeight, null, null, null);
         updateImageMetadata(metaData);
 
-        int bpp = bpp();
         ByteBuffer bb = ByteBuffer.allocate(bpp * width * height);
 
         PNGIDATChunkInputStream iDat = new PNGIDATChunkInputStream(stream, dataSize);

diff --git a/modules/javafx.graphics/src/main/java/com/sun/prism/d3d/D3DResourceFactory.java b/modules/javafx.graphics/src/main/java/com/sun/prism/d3d/D3DResourceFactory.java
@@ -166,6 +166,16 @@ public D3DTexture createTexture(PixelFormat format, Usage usagehint,
             allocw = w;
             alloch = h;
         }
+
+        if (allocw <= 0 || alloch <= 0) {
+            throw new RuntimeException("Illegal texture dimensions (" + allocw + "x" + alloch + ")");
+        }
+
+        int bpp = format.getBytesPerPixelUnit();
+        if (allocw >= (Integer.MAX_VALUE / alloch / bpp)) {
+            throw new RuntimeException("Illegal texture dimensions (" + allocw + "x" + alloch + ")");
+        }
+
         D3DVramPool pool = D3DVramPool.instance;
         long size = pool.estimateTextureSize(allocw, alloch, format);
         if (!pool.prepareForAllocation(size)) {
@@ -227,6 +237,18 @@ public Texture createTexture(MediaFrame frame) {
             frame.releaseFrame();
             return tex;
         } else {
+
+            if (texWidth <= 0 || texHeight <= 0) {
+                frame.releaseFrame();
+                throw new RuntimeException("Illegal texture dimensions (" + texWidth + "x" + texHeight + ")");
+            }
+
+            int bpp = texFormat.getBytesPerPixelUnit();
+            if (texWidth >= (Integer.MAX_VALUE / texHeight / bpp)) {
+                frame.releaseFrame();
+                throw new RuntimeException("Illegal texture dimensions (" + texWidth + "x" + texHeight + ")");
+            }
+
             D3DVramPool pool = D3DVramPool.instance;
             long size = pool.estimateTextureSize(texWidth, texHeight, texFormat);
             if (!pool.prepareForAllocation(size)) {
@@ -297,6 +319,17 @@ public D3DRTTexture createRTTexture(int width, int height, WrapMode wrapMode, bo
             createw = nextPowerOfTwo(createw, Integer.MAX_VALUE);
             createh = nextPowerOfTwo(createh, Integer.MAX_VALUE);
         }
+
+        if (createw <= 0 || createh <= 0) {
+            throw new RuntimeException("Illegal texture dimensions (" + createw + "x" + createh + ")");
+        }
+
+        PixelFormat format = PixelFormat.INT_ARGB_PRE;
+        int bpp = format.getBytesPerPixelUnit();
+        if (createw >= (Integer.MAX_VALUE / createh / bpp)) {
+            throw new RuntimeException("Illegal texture dimensions (" + createw + "x" + createh + ")");
+        }
+
         D3DVramPool pool = D3DVramPool.instance;
         int aaSamples;
         if (msaa) {
@@ -312,7 +345,7 @@ public D3DRTTexture createRTTexture(int width, int height, WrapMode wrapMode, bo
         }
 
         long pResource = nCreateTexture(context.getContextHandle(),
-                                        PixelFormat.INT_ARGB_PRE.ordinal(),
+                                        format.ordinal(),
                                         Usage.DEFAULT.ordinal(),
                                         true /*isRTT*/, createw, createh, aaSamples, false);
         if (pResource == 0L) {

diff --git a/modules/javafx.graphics/src/main/java/com/sun/prism/es2/ES2Texture.java b/modules/javafx.graphics/src/main/java/com/sun/prism/es2/ES2Texture.java
@@ -192,6 +192,15 @@ static ES2Texture create(ES2Context context, PixelFormat format,
             texHeight = nextPowerOfTwo(texHeight, maxSize);
         }
 
+        if (texWidth <= 0 || texHeight <= 0) {
+            throw new RuntimeException("Illegal texture dimensions (" + texWidth + "x" + texHeight + ")");
+        }
+
+        int bpp = format.getBytesPerPixelUnit();
+        if (texWidth >= (Integer.MAX_VALUE / texHeight / bpp)) {
+            throw new RuntimeException("Illegal texture dimensions (" + texWidth + "x" + texHeight + ")");
+        }
+
         ES2VramPool pool = ES2VramPool.instance;
         long size = pool.estimateTextureSize(texWidth, texHeight, format);
         if (!pool.prepareForAllocation(size)) {
@@ -284,6 +293,17 @@ public static Texture create(ES2Context context, MediaFrame frame) {
             texHeight = nextPowerOfTwo(texHeight, maxSize);
         }
 
+        if (texWidth <= 0 || texHeight <= 0) {
+            frame.releaseFrame();
+            throw new RuntimeException("Illegal texture dimensions (" + texWidth + "x" + texHeight + ")");
+        }
+
+        int bpp = format.getBytesPerPixelUnit();
+        if (texWidth >= (Integer.MAX_VALUE / texHeight / bpp)) {
+            frame.releaseFrame();
+            throw new RuntimeException("Illegal texture dimensions (" + texWidth + "x" + texHeight + ")");
+        }
+
         ES2VramPool pool = ES2VramPool.instance;
         long size = pool.estimateTextureSize(texWidth, texHeight, format);
         if (!pool.prepareForAllocation(size)) {

diff --git a/modules/javafx.graphics/src/main/java/com/sun/prism/impl/BaseTexture.java b/modules/javafx.graphics/src/main/java/com/sun/prism/impl/BaseTexture.java
@@ -354,6 +354,11 @@ protected void checkUpdateParams(Buffer buf, PixelFormat fmt,
             throw new IllegalArgumentException(
                 "srcw (" + srcw + ") and srch (" + srch + ") must be > 0");
         }
+        if (srcscan >= (Integer.MAX_VALUE / srch)) {
+            throw new IllegalArgumentException(
+                "srcscan * srch (" + srcscan + " * " + srch + ") must be < "
+                + "Integer.MAX_VALUE (" + Integer.MAX_VALUE + ")");
+        }
         int bytesPerPixel = fmt.getBytesPerPixelUnit();
         if (srcscan % bytesPerPixel != 0) {
             throw new IllegalArgumentException(
@@ -379,7 +384,7 @@ protected void checkUpdateParams(Buffer buf, PixelFormat fmt,
             (srcx * bytesPerPixel) + (srcy * srcscan) +
             ((srch-1) * srcscan) + (srcw * bytesPerPixel);
         int elemsNeeded = bytesNeeded / format.getDataType().getSizeInBytes();
-        if (elemsNeeded > buf.remaining()) {
+        if (elemsNeeded < 0 || elemsNeeded > buf.remaining()) {
             throw new IllegalArgumentException(
                 "Upload requires " + elemsNeeded + " elements, but only " +
                 buf.remaining() + " elements remain in the buffer");