From 44f7d1231bd94447c2e334d54d7213a8b5de2d3e Mon Sep 17 00:00:00 2001 From: Benoit Jacob Date: Wed, 25 Aug 2010 08:16:04 -0400 Subject: [PATCH] Bug 589901 - Fix validation typo in readPixels() - r=vladimir, a=blocking-beta5 --- content/canvas/src/WebGLContextGL.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/canvas/src/WebGLContextGL.cpp b/content/canvas/src/WebGLContextGL.cpp index 39843760e06e..f399c19115a1 100644 --- a/content/canvas/src/WebGLContextGL.cpp +++ b/content/canvas/src/WebGLContextGL.cpp @@ -2434,7 +2434,7 @@ WebGLContext::ReadPixels_base(WebGLint x, WebGLint y, WebGLsizei width, WebGLsiz GLsizei subrect_height = subrect_end_y - subrect_y; if (subrect_width < 0 || subrect_height < 0 || - subrect_width > width || subrect_height) + subrect_width > width || subrect_height > height) return ErrorInvalidOperation("ReadPixels: integer overflow computing clipped rect size"); // now we know that subrect_width is in the [0..width] interval, and same for heights.