wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-05 07:18:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

Add canvas data poisoning option.

Browse source 
Tag #61.
This commit is contained in:
wolfbeast 2017-09-27 11:06:31 +02:00 • committed by Roy Tam
commit 2dc214fa3b
2 changed files with 63 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

73
dom/canvas/CanvasRenderingContext2D.cpp
View file

@ -68,6 +68,8 @@
#include "CanvasImageCache.h"
#include <algorithm>
#include <stdlib.h>
#include <time.h>
#include "jsapi.h"
#include "jsfriendapi.h"
@ -2083,6 +2085,18 @@ CanvasRenderingContext2D::GetInputStream(const char* aMimeType,
return NS_ERROR_FAILURE;
}
bool PoisonData = Preferences::GetBool("canvas.poisondata",false);
if (PoisonData) {
srand(time(NULL));
// Image buffer is always a packed BGRA array (BGRX -> BGR[FF])
// so always 4-byte pixels.
// GetImageBuffer => SurfaceToPackedBGRA [=> ConvertBGRXToBGRA]
for (int32_t j = 0; j < mWidth * mHeight * 4; ++j) {
if (imageBuffer[j] !=0 && imageBuffer[j] != 255)
imageBuffer[j] += rand() % 3 - 1;
}
}
return ImageEncoder::GetInputStream(mWidth, mHeight, imageBuffer.get(),
format, encoder, aEncoderOptions,
aStream);
@ -5698,6 +5712,14 @@ CanvasRenderingContext2D::GetImageData(JSContext* aCx, double aSx,
return imageData.forget();
}
inline uint8_t PoisonValue(uint8_t v)
{
if (v==0 || v==255)
return v; //don't fuzz edges to prevent overflow/underflow
return v + rand() %3 -1;
}
nsresult
CanvasRenderingContext2D::GetImageDataArray(JSContext* aCx,
int32_t aX,
@ -5712,6 +5734,10 @@ CanvasRenderingContext2D::GetImageDataArray(JSContext* aCx,
MOZ_ASSERT(aWidth && aHeight);
bool PoisonData = Preferences::GetBool("canvas.poisondata",false);
if (PoisonData)
srand(time(NULL));
CheckedInt<uint32_t> len = CheckedInt<uint32_t>(aWidth) * aHeight * 4;
if (!len.isValid()) {
return NS_ERROR_DOM_INDEX_SIZE_ERR;
@ -5784,21 +5810,31 @@ CanvasRenderingContext2D::GetImageDataArray(JSContext* aCx,
uint8_t* dst = data + dstWriteRect.y * (aWidth * 4) + dstWriteRect.x * 4;
uint8_t a,r,g,b;
if (mOpaque) {
for (int32_t j = 0; j < dstWriteRect.height; ++j) {
for (int32_t i = 0; i < dstWriteRect.width; ++i) {
// XXX Is there some useful swizzle MMX we can use here?
#if MOZ_LITTLE_ENDIAN
uint8_t b = *src++;
uint8_t g = *src++;
uint8_t r = *src++;
b = *src++;
g = *src++;
r = *src++;
src++;
#else
src++;
uint8_t r = *src++;
uint8_t g = *src++;
uint8_t b = *src++;
r = *src++;
g = *src++;
b = *src++;
#endif
// Poison data for trackers if enabled
if (PoisonData) {
PoisonValue(r);
PoisonValue(g);
PoisonValue(b);
}
*dst++ = r;
*dst++ = g;
*dst++ = b;
@ -5812,16 +5848,25 @@ CanvasRenderingContext2D::GetImageDataArray(JSContext* aCx,
for (int32_t i = 0; i < dstWriteRect.width; ++i) {
// XXX Is there some useful swizzle MMX we can use here?
#if MOZ_LITTLE_ENDIAN
uint8_t b = *src++;
uint8_t g = *src++;
uint8_t r = *src++;
uint8_t a = *src++;
b = *src++;
g = *src++;
r = *src++;
a = *src++;
#else
uint8_t a = *src++;
uint8_t r = *src++;
uint8_t g = *src++;
uint8_t b = *src++;
a = *src++;
r = *src++;
g = *src++;
b = *src++;
#endif
// Poison data for trackers if enabled
if (PoisonData) {
PoisonValue(a);
PoisonValue(r);
PoisonValue(g);
PoisonValue(b);
}
// Convert to non-premultiplied color
*dst++ = gfxUtils::sUnpremultiplyTable[a * 256 + r];
*dst++ = gfxUtils::sUnpremultiplyTable[a * 256 + g];

4
modules/libpref/init/all.js
View file

@ -4448,6 +4448,10 @@ pref("image.multithreaded_decoding.limit", -1);
// cache.
pref("canvas.image.cache.limit", 0);
// Allow track-fobics to deliberately poison canvas data for
// toDataURL() and getImageData()
pref("canvas.poisondata", false);
// WebGL prefs
#ifdef ANDROID
// Disable MSAA on mobile.