commit 5bec6fe272396b07db853f0672fe4b0348e465f7
author said@apple.com <said@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Fri Apr 08 20:07:51 2016 +0000
committer said@apple.com <said@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Fri Apr 08 20:07:51 2016 +0000
tree 322164382ef832a1c41af45267857362f9e0ccf0
parent 371eaff54d7342c4ca333f22e251b4e8e4b3ed5d

Timing attack on SVG feComposite filter circumvents same-origin policy
https://bugs.webkit.org/show_bug.cgi?id=154338

Patch by Said Abou-Hallawa <sabouhallawa@apple,com> on 2016-04-08
Reviewed by Oliver Hunt.

Ensure the FEComposite arithmetic filter is clamping the resulted color
components in a constant time.

* platform/graphics/filters/FEComposite.cpp:
(WebCore::clampByte):
(WebCore::computeArithmeticPixels):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@199243 268f45cc-cd09-0410-ab3c-d52691b4dbfc