Bug 503928. Cap blur box size to 1024 pixels to avoid pathological behaviour. r=longsonr

--HG--
extra : rebase_source : 6ce4a3b197a567c15cc3d9f5aa8d262e84b4ebe2
This commit is contained in:
Robert O'Callahan 2009-07-27 10:09:20 +12:00
parent 72e0fc455e
commit d83933dd9b

View File

@ -549,6 +549,19 @@ BoxBlur(const PRUint8 *aInput, PRUint8 *aOutput,
}
}
static PRUint32
GetBlurBoxSize(double aStdDev)
{
NS_ASSERTION(aStdDev >= 0, "Negative standard deviations not allowed");
double size = aStdDev*3*sqrt(2*M_PI)/4;
// Doing super-large blurs accurately isn't very important.
PRUint32 max = 1024;
if (size > max)
return max;
return PRUint32(floor(size + 0.5));
}
nsresult
nsSVGFEGaussianBlurElement::GetDXY(PRUint32 *aDX, PRUint32 *aDY,
const nsSVGFilterInstance& aInstance)
@ -569,8 +582,11 @@ nsSVGFEGaussianBlurElement::GetDXY(PRUint32 *aDX, PRUint32 *aDY,
if (stdX == 0 || stdY == 0)
return NS_ERROR_UNEXPECTED;
*aDX = PRUint32(floor(stdX * 3*sqrt(2*M_PI)/4 + 0.5));
*aDY = PRUint32(floor(stdY * 3*sqrt(2*M_PI)/4 + 0.5));
// If the box size is greater than twice the temporary surface size
// in an axis, then each pixel will be set to the average of all the
// other pixel values.
*aDX = GetBlurBoxSize(stdX);
*aDY = GetBlurBoxSize(stdY);
return NS_OK;
}