Skip to content
This repository was archived by the owner on Jul 17, 2024. It is now read-only.
/ jfx22u Public archive

Commit c7a1af7

Browse files
kevinrushforthkevinrushforth
committedSep 1, 2023
8313056: General enhancements of Glass
Reviewed-by: lkostyra, arapte, rhalade
·
22+3022-ga
1 parent beca88c commit c7a1af7

File tree

9 files changed

+238
-173
lines changed

9 files changed

+238
-173
lines changed
 

‎modules/javafx.graphics/src/main/java/com/sun/glass/ui/Pixels.java

+19-24
Original file line numberDiff line numberDiff line change
@@ -85,25 +85,22 @@ public static int getNativeFormat() {
8585
private final float scaley;
8686

8787
protected Pixels(final int width, final int height, final ByteBuffer pixels) {
88-
this.width = width;
89-
this.height = height;
90-
this.bytesPerComponent = 1;
91-
this.bytes = pixels.slice();
92-
if ((this.width <= 0) || (this.height <= 0) || ((this.width * this.height * 4) > this.bytes.capacity())) {
93-
throw new IllegalArgumentException("Too small byte buffer size "+this.width+"x"+this.height+" ["+(this.width*this.height*4)+"] > "+this.bytes.capacity());
94-
}
95-
96-
this.ints = null;
97-
this.scalex = 1.0f;
98-
this.scaley = 1.0f;
88+
this(width, height, pixels, 1.0f, 1.0f);
9989
}
10090

10191
protected Pixels(final int width, final int height, final ByteBuffer pixels, float scalex, float scaley) {
10292
this.width = width;
10393
this.height = height;
10494
this.bytesPerComponent = 1;
10595
this.bytes = pixels.slice();
106-
if ((this.width <= 0) || (this.height <= 0) || ((this.width * this.height * 4) > this.bytes.capacity())) {
96+
97+
if (this.width <= 0 || this.height <= 0 ||
98+
this.width > ((Integer.MAX_VALUE / 4) / this.height)) {
99+
100+
throw new IllegalArgumentException("Invalid width*height");
101+
}
102+
103+
if ((this.width * this.height * 4) > this.bytes.capacity()) {
107104
throw new IllegalArgumentException("Too small byte buffer size "+this.width+"x"+this.height+" ["+(this.width*this.height*4)+"] > "+this.bytes.capacity());
108105
}
109106

@@ -113,25 +110,22 @@ protected Pixels(final int width, final int height, final ByteBuffer pixels, flo
113110
}
114111

115112
protected Pixels(final int width, final int height, IntBuffer pixels) {
116-
this.width = width;
117-
this.height = height;
118-
this.bytesPerComponent = 4;
119-
this.ints = pixels.slice();
120-
if ((this.width <= 0) || (this.height <= 0) || ((this.width * this.height) > this.ints.capacity())) {
121-
throw new IllegalArgumentException("Too small int buffer size "+this.width+"x"+this.height+" ["+(this.width*this.height)+"] > "+this.ints.capacity());
122-
}
123-
124-
this.bytes = null;
125-
this.scalex = 1.0f;
126-
this.scaley = 1.0f;
113+
this(width, height, pixels, 1.0f, 1.0f);
127114
}
128115

129116
protected Pixels(final int width, final int height, IntBuffer pixels, float scalex, float scaley) {
130117
this.width = width;
131118
this.height = height;
132119
this.bytesPerComponent = 4;
133120
this.ints = pixels.slice();
134-
if ((this.width <= 0) || (this.height <= 0) || ((this.width * this.height) > this.ints.capacity())) {
121+
122+
if (this.width <= 0 || this.height <= 0 ||
123+
this.width > ((Integer.MAX_VALUE / 4) / this.height)) {
124+
125+
throw new IllegalArgumentException("Invalid width*height");
126+
}
127+
128+
if ((this.width * this.height) > this.ints.capacity()) {
135129
throw new IllegalArgumentException("Too small int buffer size "+this.width+"x"+this.height+" ["+(this.width*this.height)+"] > "+this.ints.capacity());
136130
}
137131

@@ -238,6 +232,7 @@ public final void asByteBuffer(ByteBuffer bb) {
238232
throw new RuntimeException("Too small buffer.");
239233
}
240234
_fillDirectByteBuffer(bb);
235+
bb.rewind();
241236
}
242237

243238
// This method is called from the native code to reduce the number of JNI up-calls.

‎modules/javafx.graphics/src/main/java/com/sun/glass/ui/gtk/GtkPixels.java

+7-18
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@
2525
package com.sun.glass.ui.gtk;
2626

2727
import com.sun.glass.ui.Pixels;
28-
import java.nio.Buffer;
2928
import java.nio.ByteBuffer;
3029
import java.nio.IntBuffer;
3130

@@ -52,31 +51,21 @@ protected void _fillDirectByteBuffer(ByteBuffer bb) {
5251
// Taken from MacPixels
5352
if (this.bytes != null) {
5453
this.bytes.rewind();
55-
if (this.bytes.isDirect()) {
56-
_copyPixels(bb, this.bytes, getWidth()*getHeight());
57-
} else {
58-
bb.put(this.bytes);
59-
}
54+
bb.put(this.bytes);
6055
this.bytes.rewind();
6156
} else {
6257
this.ints.rewind();
63-
if (this.ints.isDirect()) {
64-
_copyPixels(bb, this.ints, getWidth()*getHeight());
65-
} else {
66-
for (int i=0; i<this.ints.capacity(); i++) {
67-
int data = this.ints.get();
68-
bb.put((byte)((data)&0xff));
69-
bb.put((byte)((data>>8)&0xff));
70-
bb.put((byte)((data>>16)&0xff));
71-
bb.put((byte)((data>>24)&0xff));
72-
}
58+
for (int i=0; i<this.ints.capacity(); i++) {
59+
int data = this.ints.get();
60+
bb.put((byte)((data)&0xff));
61+
bb.put((byte)((data>>8)&0xff));
62+
bb.put((byte)((data>>16)&0xff));
63+
bb.put((byte)((data>>24)&0xff));
7364
}
7465
this.ints.rewind();
7566
}
7667
}
7768

78-
protected native void _copyPixels(Buffer dst, Buffer src, int size);
79-
8069
@Override
8170
protected native void _attachInt(long ptr, int w, int h, IntBuffer ints, int[] array, int offset);
8271

‎modules/javafx.graphics/src/main/java/com/sun/glass/ui/mac/MacPixels.java

+8-17
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@
2424
*/
2525
package com.sun.glass.ui.mac;
2626

27-
import java.nio.Buffer;
2827
import java.nio.ByteBuffer;
2928
import java.nio.IntBuffer;
3029

@@ -66,29 +65,21 @@ protected MacPixels(int width, int height, IntBuffer data, float scalex, float s
6665
protected void _fillDirectByteBuffer(ByteBuffer bb) {
6766
if (this.bytes != null) {
6867
this.bytes.rewind();
69-
if (this.bytes.isDirect() == true) {
70-
_copyPixels(bb, this.bytes, getWidth()*getHeight());
71-
} else {
72-
bb.put(this.bytes);
73-
}
68+
bb.put(this.bytes);
7469
this.bytes.rewind();
7570
} else {
7671
this.ints.rewind();
77-
if (this.ints.isDirect() == true) {
78-
_copyPixels(bb, this.ints, getWidth()*getHeight());
79-
} else {
80-
for (int i=0; i<this.ints.capacity(); i++) {
81-
int data = this.ints.get();
82-
bb.put((byte)((data>>0)&0xff));
83-
bb.put((byte)((data>>8)&0xff));
84-
bb.put((byte)((data>>16)&0xff));
85-
bb.put((byte)((data>>24)&0xff));
86-
}
72+
for (int i=0; i<this.ints.capacity(); i++) {
73+
int data = this.ints.get();
74+
bb.put((byte)((data>>0)&0xff));
75+
bb.put((byte)((data>>8)&0xff));
76+
bb.put((byte)((data>>16)&0xff));
77+
bb.put((byte)((data>>24)&0xff));
8778
}
8879
this.ints.rewind();
8980
}
9081
}
91-
native protected void _copyPixels(Buffer src, Buffer dst, int size);
82+
9283
@Override native protected void _attachInt(long ptr, int w, int h, IntBuffer ints, int[] array, int offset);
9384
@Override native protected void _attachByte(long ptr, int w, int h, ByteBuffer bytes, byte[] array, int offset);
9485

‎modules/javafx.graphics/src/main/java/com/sun/glass/ui/mac/MacView.java

+3-3
Original file line numberDiff line numberDiff line change
@@ -99,9 +99,9 @@ static int getMultiClickMaxY_impl() {
9999
pixels.getWidth(), pixels.getHeight(), pixels.getScaleX(), pixels.getScaleY());
100100
}
101101
}
102-
native void _uploadPixelsDirect(long viewPtr, Buffer pixels, int width, int height, float scaleX, float scaleY);
103-
native void _uploadPixelsByteArray(long viewPtr, byte[] pixels, int offset, int width, int height, float scaleX, float scaleY);
104-
native void _uploadPixelsIntArray(long viewPtr, int[] pixels, int offset, int width, int height, float scaleX, float scaleY);
102+
private native void _uploadPixelsDirect(long viewPtr, Buffer pixels, int width, int height, float scaleX, float scaleY);
103+
private native void _uploadPixelsByteArray(long viewPtr, byte[] pixels, int offset, int width, int height, float scaleX, float scaleY);
104+
private native void _uploadPixelsIntArray(long viewPtr, int[] pixels, int offset, int width, int height, float scaleX, float scaleY);
105105

106106
@Override
107107
protected void notifyResize(int width, int height) {

‎modules/javafx.graphics/src/main/native-glass/gtk/GlassPixels.cpp

+44-23
Original file line numberDiff line numberDiff line change
@@ -40,25 +40,6 @@ static void my_free(guchar *pixels, gpointer data) {
4040

4141
extern "C" {
4242

43-
/*
44-
* Class: com_sun_glass_ui_gtk_GtkPixels
45-
* Method: _copyPixels
46-
* Signature: (Ljava/nio/Buffer;Ljava/nio/Buffer;I)V
47-
*/
48-
JNIEXPORT void JNICALL Java_com_sun_glass_ui_gtk_GtkPixels__1copyPixels
49-
(JNIEnv *env, jobject obj, jobject jDst, jobject jSrc, jint jSize)
50-
{
51-
(void)obj;
52-
53-
//Taken from MacPixels (and fixed)
54-
void *src = env->GetDirectBufferAddress(jSrc);
55-
void *dst = env->GetDirectBufferAddress(jDst);
56-
if ((src != NULL) && (dst != NULL) && (jSize > 0))
57-
{
58-
memcpy(dst, src, jSize * 4);
59-
}
60-
}
61-
6243
/*
6344
* Class: com_sun_glass_ui_gtk_GtkPixels
6445
* Method: _attachInt
@@ -69,15 +50,35 @@ JNIEXPORT void JNICALL Java_com_sun_glass_ui_gtk_GtkPixels__1attachInt
6950
{
7051
(void)obj;
7152

53+
if (!ptr) return;
54+
if (!array && !ints) return;
55+
if (offset < 0) return;
56+
if (w <= 0 || h <= 0) return;
57+
58+
if (w > (((INT_MAX - offset) / 4) / h))
59+
{
60+
return;
61+
}
62+
7263
jint *data;
7364
GdkPixbuf **pixbuf;
7465
guint8 *dataRGBA;
7566

67+
jsize numElem;
68+
if (array == NULL) {
69+
numElem = env->GetDirectBufferCapacity(ints);
70+
} else {
71+
numElem = env->GetArrayLength(array);
72+
}
73+
74+
if ((w * h + offset) > numElem)
75+
{
76+
return;
77+
}
78+
7679
if (array == NULL) {
7780
data = (jint*) env->GetDirectBufferAddress(ints);
78-
assert((w*h*4 + offset * 4) == env->GetDirectBufferCapacity(ints));
7981
} else {
80-
assert((w*h + offset) == env->GetArrayLength(array));
8182
data = (jint*) env->GetPrimitiveArrayCritical(array, 0);
8283
}
8384

@@ -101,15 +102,35 @@ JNIEXPORT void JNICALL Java_com_sun_glass_ui_gtk_GtkPixels__1attachByte
101102
{
102103
(void)obj;
103104

105+
if (!ptr) return;
106+
if (!array && !bytes) return;
107+
if (offset < 0) return;
108+
if (w <= 0 || h <= 0) return;
109+
110+
if (w > (((INT_MAX - offset) / 4) / h))
111+
{
112+
return;
113+
}
114+
104115
jbyte *data;
105116
GdkPixbuf **pixbuf;
106117
guint8 *dataRGBA;
107118

119+
jsize numElem;
120+
if (array == NULL) {
121+
numElem = env->GetDirectBufferCapacity(bytes);
122+
} else {
123+
numElem = env->GetArrayLength(array);
124+
}
125+
126+
if ((w * h * 4 + offset) > numElem)
127+
{
128+
return;
129+
}
130+
108131
if (array == NULL) {
109132
data = (jbyte*) env->GetDirectBufferAddress(bytes);
110-
assert((w*h*4 + offset) == env->GetDirectBufferCapacity(bytes));
111133
} else {
112-
assert((w*h*4 + offset) == env->GetArrayLength(array));
113134
data = (jbyte*) env->GetPrimitiveArrayCritical(array, 0);
114135
}
115136

‎modules/javafx.graphics/src/main/native-glass/gtk/GlassView.cpp

+33-2
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,9 @@ JNIEXPORT void JNICALL Java_com_sun_glass_ui_gtk_GtkView__1uploadPixelsDirect
185185
{
186186
(void)jView;
187187

188+
if (!ptr) return;
189+
if (!buffer) return;
190+
188191
GlassView* view = JLONG_TO_GLASSVIEW(ptr);
189192
if (view->current_window) {
190193
void *data = env->GetDirectBufferAddress(buffer);
@@ -203,10 +206,24 @@ JNIEXPORT void JNICALL Java_com_sun_glass_ui_gtk_GtkView__1uploadPixelsIntArray
203206
{
204207
(void)obj;
205208

209+
if (!ptr) return;
210+
if (!array) return;
211+
if (offset < 0) return;
212+
if (width <= 0 || height <= 0) return;
213+
214+
if (width > ((INT_MAX - offset) / height))
215+
{
216+
return;
217+
}
218+
219+
if ((width * height + offset) > env->GetArrayLength(array))
220+
{
221+
return;
222+
}
223+
206224
GlassView* view = JLONG_TO_GLASSVIEW(ptr);
207225
if (view->current_window) {
208226
int *data = NULL;
209-
assert((width*height + offset) == env->GetArrayLength(array));
210227
data = (int*)env->GetPrimitiveArrayCritical(array, 0);
211228

212229
view->current_window->paint(data + offset, width, height);
@@ -225,11 +242,25 @@ JNIEXPORT void JNICALL Java_com_sun_glass_ui_gtk_GtkView__1uploadPixelsByteArray
225242
{
226243
(void)obj;
227244

245+
if (!ptr) return;
246+
if (!array) return;
247+
if (offset < 0) return;
248+
if (width <= 0 || height <= 0) return;
249+
250+
if (width > (((INT_MAX - offset) / 4) / height))
251+
{
252+
return;
253+
}
254+
255+
if ((4 * width * height + offset) > env->GetArrayLength(array))
256+
{
257+
return;
258+
}
259+
228260
GlassView* view = JLONG_TO_GLASSVIEW(ptr);
229261
if (view->current_window) {
230262
unsigned char *data = NULL;
231263

232-
assert((4*width*height + offset) == env->GetArrayLength(array));
233264
data = (unsigned char*)env->GetPrimitiveArrayCritical(array, 0);
234265

235266
view->current_window->paint(data + offset, width, height);

‎modules/javafx.graphics/src/main/native-glass/mac/GlassPixels.m

+75-42
Original file line numberDiff line numberDiff line change
@@ -56,40 +56,6 @@
5656
return com_sun_glass_ui_Pixels_Format_BYTE_BGRA_PRE;
5757
}
5858

59-
/*
60-
* Class: com_sun_glass_ui_mac_MacPixels
61-
* Method: _copyPixels
62-
* Signature: (Ljava/nio/Buffer;Ljava/nio/Buffer;I)V
63-
*/
64-
JNIEXPORT void JNICALL Java_com_sun_glass_ui_mac_MacPixels__1copyPixels
65-
(JNIEnv *env, jobject jPixels, jobject jSrc, jobject jDst, jint jSize)
66-
{
67-
LOG("Java_com_sun_glass_ui_mac_MacPixels__1copyPixels");
68-
69-
GLASS_ASSERT_MAIN_JAVA_THREAD(env);
70-
71-
void *src = (*env)->GetDirectBufferAddress(env, jSrc);
72-
void *dst = (*env)->GetDirectBufferAddress(env, jDst);
73-
if ((src != NULL) && (src != NULL) && (jSize > 0))
74-
{
75-
memcpy(src, dst, jSize);
76-
}
77-
GLASS_CHECK_EXCEPTION(env);
78-
}
79-
80-
/*
81-
* Class: com_sun_glass_ui_mac_MacPixels
82-
* Method: _attachInt
83-
* Signature: (JIILjava/nio/IntBuffer;[II)V
84-
*/
85-
JNIEXPORT void JNICALL Java_com_sun_glass_ui_mac_MacPixels__1attachInt
86-
(JNIEnv *env, jobject jPixels, jlong jPtr, jint jWidth, jint jHeight, jobject jBuffer, jintArray jArray, jint jOffset)
87-
{
88-
LOG("Java_com_sun_glass_ui_mac_MacPixels__1attachInt");
89-
90-
Java_com_sun_glass_ui_mac_MacPixels__1attachByte(env, jPixels, jPtr, jWidth, jHeight, jBuffer, jArray, 4*jOffset);
91-
}
92-
9359
NSImage* getImage(u_int8_t* data, int jWidth, int jHeight, int jOffset) {
9460
NSImage* image = NULL;
9561
CGImageRef cgImage = NULL;
@@ -119,16 +85,9 @@
11985
return image;
12086
}
12187

122-
/*
123-
* Class: com_sun_glass_ui_mac_MacPixels
124-
* Method: _attachByte
125-
* Signature: (JIILjava/nio/ByteBuffer;[BI)V
126-
*/
127-
JNIEXPORT void JNICALL Java_com_sun_glass_ui_mac_MacPixels__1attachByte
88+
void attachCommon
12889
(JNIEnv *env, jobject jPixels, jlong jPtr, jint jWidth, jint jHeight, jobject jBuffer, jbyteArray jArray, jint jOffset)
12990
{
130-
LOG("Java_com_sun_glass_ui_mac_MacPixels__1attachByte");
131-
13291
GLASS_ASSERT_MAIN_JAVA_THREAD(env);
13392
{
13493
u_int8_t *data = NULL;
@@ -152,3 +111,77 @@
152111
}
153112
GLASS_CHECK_EXCEPTION(env);
154113
}
114+
115+
/*
116+
* Class: com_sun_glass_ui_mac_MacPixels
117+
* Method: _attachInt
118+
* Signature: (JIILjava/nio/IntBuffer;[II)V
119+
*/
120+
JNIEXPORT void JNICALL Java_com_sun_glass_ui_mac_MacPixels__1attachInt
121+
(JNIEnv *env, jobject jPixels, jlong jPtr, jint jWidth, jint jHeight, jobject jBuffer, jintArray jArray, jint jOffset)
122+
{
123+
LOG("Java_com_sun_glass_ui_mac_MacPixels__1attachInt");
124+
125+
if (!jPtr) return;
126+
if (!(jArray || jBuffer)) return;
127+
if (jOffset < 0) return;
128+
if (jWidth <= 0 || jHeight <= 0) return;
129+
130+
if (jOffset > (INT_MAX / 4)) {
131+
return;
132+
}
133+
134+
if (jWidth > (((INT_MAX - 4 * jOffset) / 4) / jHeight))
135+
{
136+
return;
137+
}
138+
139+
jsize numElem;
140+
if (jArray != NULL) {
141+
numElem = (*env)->GetArrayLength(env, jArray);
142+
} else {
143+
numElem = (*env)->GetDirectBufferCapacity(env, jBuffer);
144+
}
145+
146+
if ((jWidth * jHeight + jOffset) > numElem)
147+
{
148+
return;
149+
}
150+
151+
attachCommon(env, jPixels, jPtr, jWidth, jHeight, jBuffer, jArray, 4 * jOffset);
152+
}
153+
154+
/*
155+
* Class: com_sun_glass_ui_mac_MacPixels
156+
* Method: _attachByte
157+
* Signature: (JIILjava/nio/ByteBuffer;[BI)V
158+
*/
159+
JNIEXPORT void JNICALL Java_com_sun_glass_ui_mac_MacPixels__1attachByte
160+
(JNIEnv *env, jobject jPixels, jlong jPtr, jint jWidth, jint jHeight, jobject jBuffer, jbyteArray jArray, jint jOffset)
161+
{
162+
LOG("Java_com_sun_glass_ui_mac_MacPixels__1attachByte");
163+
164+
if (!jPtr) return;
165+
if (!(jArray || jBuffer)) return;
166+
if (jOffset < 0) return;
167+
if (jWidth <= 0 || jHeight <= 0) return;
168+
169+
if (jWidth > (((INT_MAX - jOffset) / 4) / jHeight))
170+
{
171+
return;
172+
}
173+
174+
jsize numElem;
175+
if (jArray != NULL) {
176+
numElem = (*env)->GetArrayLength(env, jArray);
177+
} else {
178+
numElem = (*env)->GetDirectBufferCapacity(env, jBuffer);
179+
}
180+
181+
if ((4 * jWidth * jHeight + jOffset) > numElem)
182+
{
183+
return;
184+
}
185+
186+
attachCommon(env, jPixels, jPtr, jWidth, jHeight, jBuffer, jArray, jOffset);
187+
}

‎modules/javafx.graphics/src/main/native-glass/mac/GlassView.m

+29-41
Original file line numberDiff line numberDiff line change
@@ -43,23 +43,6 @@
4343
#define LOG(MSG, ...) GLASS_LOG(MSG, ## __VA_ARGS__);
4444
#endif
4545

46-
//#define FORCE_NOISE
47-
#ifdef FORCE_NOISE
48-
static inline void *_GenerateNoise(int width, int height)
49-
{
50-
static int *pixels = NULL;
51-
pixels = realloc(pixels, width*height*4);
52-
53-
int *src = pixels;
54-
for (int i=0; i<width*height; i++)
55-
{
56-
*src++ = random();
57-
}
58-
59-
return (void*)pixels;
60-
}
61-
#endif
62-
6346
static inline NSView<GlassView>* getGlassView(JNIEnv *env, jlong jPtr)
6447
{
6548
assert(jPtr != 0L);
@@ -613,15 +596,12 @@
613596
{
614597
LOG("Java_com_sun_glass_ui_mac_MacView__1uploadPixelsDirect");
615598
if (!jPtr) return;
599+
if (!jBuffer) return;
616600

617601
GLASS_ASSERT_MAIN_JAVA_THREAD(env);
618602
NSView<GlassView> *view = getGlassView(env, jPtr);
619603

620-
#ifndef FORCE_NOISE
621604
void *pixels = (*env)->GetDirectBufferAddress(env, jBuffer);
622-
#else
623-
void *pixels = _GenerateNoise(jWidth, jHeight);
624-
#endif
625605

626606
// must be in the middle of begin/end
627607
if ((jWidth > 0) && (jHeight > 0))
@@ -640,27 +620,31 @@
640620
{
641621
LOG("Java_com_sun_glass_ui_mac_MacView__1uploadPixelsByteArray");
642622
if (!jPtr) return;
623+
if (!jArray) return;
624+
if (jOffset < 0) return;
625+
if (jWidth <= 0 || jHeight <= 0) return;
626+
627+
if (jWidth > (((INT_MAX - jOffset) / 4) / jHeight))
628+
{
629+
return;
630+
}
643631

644632
GLASS_ASSERT_MAIN_JAVA_THREAD(env);
645633

634+
if ((4 * jWidth * jHeight + jOffset) > (*env)->GetArrayLength(env, jArray))
635+
{
636+
return;
637+
}
638+
646639
jboolean isCopy = JNI_FALSE;
647640
u_int8_t *data = (*env)->GetPrimitiveArrayCritical(env, jArray, &isCopy);
648641
{
649-
assert((4*jWidth*jHeight + jOffset) == (*env)->GetArrayLength(env, jArray));
650-
651642
NSView<GlassView> *view = getGlassView(env, jPtr);
652643

653-
#ifndef FORCE_NOISE
654644
void *pixels = (data+jOffset);
655-
#else
656-
void *pixels = _GenerateNoise(jWidth, jHeight);
657-
#endif
658645

659646
// must be in the middle of begin/end
660-
if ((jWidth > 0) && (jHeight > 0))
661-
{
662-
[view pushPixels:pixels withWidth:(GLuint)jWidth withHeight:(GLuint)jHeight withScaleX:(GLfloat)jScaleX withScaleY:(GLfloat)jScaleY withEnv:env];
663-
}
647+
[view pushPixels:pixels withWidth:(GLuint)jWidth withHeight:(GLuint)jHeight withScaleX:(GLfloat)jScaleX withScaleY:(GLfloat)jScaleY withEnv:env];
664648
}
665649
(*env)->ReleasePrimitiveArrayCritical(env, jArray, data, JNI_ABORT);
666650
}
@@ -675,27 +659,31 @@
675659
{
676660
LOG("Java_com_sun_glass_ui_mac_MacView__1uploadPixelsIntArray");
677661
if (!jPtr) return;
662+
if (!jArray) return;
663+
if (jOffset < 0) return;
664+
if (jWidth <= 0 || jHeight <= 0) return;
665+
666+
if (jWidth > ((INT_MAX - jOffset) / jHeight))
667+
{
668+
return;
669+
}
678670

679671
GLASS_ASSERT_MAIN_JAVA_THREAD(env);
680672

673+
if ((jWidth * jHeight + jOffset) > (*env)->GetArrayLength(env, jArray))
674+
{
675+
return;
676+
}
677+
681678
jboolean isCopy = JNI_FALSE;
682679
u_int32_t *data = (*env)->GetPrimitiveArrayCritical(env, jArray, &isCopy);
683680
{
684-
assert((jWidth*jHeight + jOffset) == (*env)->GetArrayLength(env, jArray));
685-
686681
NSView<GlassView> *view = getGlassView(env, jPtr);
687682

688-
#ifndef FORCE_NOISE
689683
void *pixels = (data+jOffset);
690-
#else
691-
void *pixels = _GenerateNoise(jWidth, jHeight);
692-
#endif
693684

694685
// must be in the middle of begin/end
695-
if ((jWidth > 0) && (jHeight > 0))
696-
{
697-
[view pushPixels:pixels withWidth:(GLuint)jWidth withHeight:(GLuint)jHeight withScaleX:(GLfloat)jScaleX withScaleY:(GLfloat)jScaleY withEnv:env];
698-
}
686+
[view pushPixels:pixels withWidth:(GLuint)jWidth withHeight:(GLuint)jHeight withScaleX:(GLfloat)jScaleX withScaleY:(GLfloat)jScaleY withEnv:env];
699687
}
700688
(*env)->ReleasePrimitiveArrayCritical(env, jArray, data, JNI_ABORT);
701689
}

‎modules/javafx.graphics/src/main/native-glass/win/Pixels.cpp

+20-3
Original file line numberDiff line numberDiff line change
@@ -248,9 +248,26 @@ JNIEXPORT void JNICALL Java_com_sun_glass_ui_win_WinPixels__1fillDirectByteBuffe
248248
{
249249
Pixels pixels(env, jPixels);
250250

251-
memcpy(env->GetDirectBufferAddress(bb), pixels.GetBits(),
252-
pixels.GetWidth() * pixels.GetHeight() * 4);
251+
if (bb == NULL) {
252+
return;
253+
}
254+
255+
const int width = pixels.GetWidth();
256+
const int height = pixels.GetHeight();
257+
if (width <= 0 || height <= 0 || width > ((INT_MAX / 4) / height)) {
258+
return;
259+
}
260+
const int size = width * height * 4;
261+
const int bbCapacity = env->GetDirectBufferCapacity(bb);
262+
if (bbCapacity < size) {
263+
return;
264+
}
265+
266+
void *bbAddr = env->GetDirectBufferAddress(bb);
267+
if (bbAddr == NULL) {
268+
return;
269+
}
270+
memcpy(bbAddr, pixels.GetBits(), size);
253271
}
254272

255273
} // extern "C"
256-

0 commit comments

Comments
 (0)
This repository has been archived.