1 files changed, 83 insertions, 0 deletions
diff --git a/gnu/packages/patches/icecat-CVE-2016-1930-pt14.patch b/gnu/packages/patches/icecat-CVE-2016-1930-pt14.patch
new file mode 100644
index 0000000000..02c1af1775
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2016-1930-pt14.patch
@@ -0,0 +1,83 @@
+Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/94a95291d095
+Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/
+Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1224200
+
+# HG changeset patch
+# User Timothy Nikkel <tnikkel@gmail.com>
+# Date 1453303652 -3600
+# Node ID 94a95291d0958439dbed5b7dc99fae59e1318592
+# Parent  999c13acb40e1113306c65925a7d96688339d945
+Bug 1224200 - Allow downscaler to get (and ignore) new input lines after it has finished producing all output lines. r=seth, a=lizzard
+
+diff --git a/image/src/Downscaler.cpp b/image/src/Downscaler.cpp
+--- a/image/src/Downscaler.cpp
++++ b/image/src/Downscaler.cpp
+@@ -145,43 +145,44 @@ GetFilterOffsetAndLength(UniquePtr<skia:
+                           aFilterLengthOut);
+ }
+ 
+ void
+ Downscaler::CommitRow()
+ {
+   MOZ_ASSERT(mOutputBuffer, "Should have a current frame");
+   MOZ_ASSERT(mCurrentInLine < mOriginalSize.height, "Past end of input");
+-  MOZ_ASSERT(mCurrentOutLine < mTargetSize.height, "Past end of output");
+ 
+-  int32_t filterOffset = 0;
+-  int32_t filterLength = 0;
+-  GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
+-                           &filterOffset, &filterLength);
++  if (mCurrentOutLine < mTargetSize.height) {
++    int32_t filterOffset = 0;
++    int32_t filterLength = 0;
++    GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
++                             &filterOffset, &filterLength);
+ 
+-  int32_t inLineToRead = filterOffset + mLinesInBuffer;
+-  MOZ_ASSERT(mCurrentInLine <= inLineToRead, "Reading past end of input");
+-  if (mCurrentInLine == inLineToRead) {
+-    skia::ConvolveHorizontally(mRowBuffer.get(), *mXFilter,
+-                               mWindow[mLinesInBuffer++], mHasAlpha,
+-                               /* use_sse2 = */ true);
+-  }
+-
+-  MOZ_ASSERT(mCurrentOutLine < mTargetSize.height,
+-             "Writing past end of output");
+-
+-  while (mLinesInBuffer == filterLength) {
+-    DownscaleInputLine();
+-
+-    if (mCurrentOutLine == mTargetSize.height) {
+-      break;  // We're done.
++    int32_t inLineToRead = filterOffset + mLinesInBuffer;
++    MOZ_ASSERT(mCurrentInLine <= inLineToRead, "Reading past end of input");
++    if (mCurrentInLine == inLineToRead) {
++      skia::ConvolveHorizontally(mRowBuffer.get(), *mXFilter,
++                                 mWindow[mLinesInBuffer++], mHasAlpha,
++                                 /* use_sse2 = */ true);
+     }
+ 
+-    GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
+-                             &filterOffset, &filterLength);
++    MOZ_ASSERT(mCurrentOutLine < mTargetSize.height,
++               "Writing past end of output");
++
++    while (mLinesInBuffer == filterLength) {
++      DownscaleInputLine();
++
++      if (mCurrentOutLine == mTargetSize.height) {
++        break;  // We're done.
++      }
++
++      GetFilterOffsetAndLength(mYFilter, mCurrentOutLine,
++                               &filterOffset, &filterLength);
++    }
+   }
+ 
+   mCurrentInLine += 1;
+ }
+ 
+ bool
+ Downscaler::HasInvalidation() const
+ {
+