From 44ff933dd86b40306ce4d28b7fe194a23db7d019 Mon Sep 17 00:00:00 2001
From: Andrew Paseltiner <apaseltiner@chromium.org>
Date: Tue, 26 May 2026 05:31:37 -0700
Subject: [PATCH] Set status out parameter in CSSURLImageValue::GetSourceImageForCanvas

All other overrides of this method set the status parameter; without it
Canvas2DRecorderContext::createPattern could read uninitialized memory.

We also initialize the status in that method to
kInvalidSourceImageStatus for defense in depth.

Fixed: 513178869
Change-Id: I57efec25d105ffe9110c3092ebacb6c2f5dc0d9c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7849816
Reviewed-by: Stephen White <senorblanco@chromium.org>
Reviewed-by: Jean-Philippe Gravel <jpgravel@chromium.org>
Commit-Queue: Andrew Paseltiner <apaseltiner@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1636100}
---

diff --git a/third_party/blink/renderer/core/css/cssom/css_style_image_value_test.cc b/third_party/blink/renderer/core/css/cssom/css_style_image_value_test.cc
index 71cbe02..4408890 100644
--- a/third_party/blink/renderer/core/css/cssom/css_style_image_value_test.cc
+++ b/third_party/blink/renderer/core/css/cssom/css_style_image_value_test.cc
@@ -5,6 +5,9 @@
 #include "third_party/blink/renderer/core/css/cssom/css_style_image_value.h"
 
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/renderer/core/css/css_image_value.h"
+#include "third_party/blink/renderer/core/css/css_url_data.h"
+#include "third_party/blink/renderer/core/css/cssom/css_url_image_value.h"
 #include "third_party/blink/renderer/platform/graphics/image.h"
 #include "third_party/blink/renderer/platform/heap/garbage_collected.h"
 
@@ -69,4 +72,18 @@
   EXPECT_FALSE(is_null);
 }
 
+TEST(CSSURLImageValueTest, GetSourceImageForCanvasSetsStatus) {
+  auto* url_data = MakeGarbageCollected<CSSUrlData>(
+      AtomicString("https://example.com/image.png"));
+  auto* css_image_value = MakeGarbageCollected<CSSImageValue>(*url_data);
+  auto* url_image_value =
+      MakeGarbageCollected<CSSURLImageValue>(*css_image_value);
+
+  SourceImageStatus status = kNormalSourceImageStatus;
+  url_image_value->GetSourceImageForCanvas(&status, gfx::SizeF(100, 100));
+  // Since the image is not loaded, GetImage() returns null, and status should
+  // be kInvalidSourceImageStatus.
+  EXPECT_EQ(status, kInvalidSourceImageStatus);
+}
+
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/css/cssom/css_url_image_value.cc b/third_party/blink/renderer/core/css/cssom/css_url_image_value.cc
index 3a78ba3..8ae283da 100644
--- a/third_party/blink/renderer/core/css/cssom/css_url_image_value.cc
+++ b/third_party/blink/renderer/core/css/cssom/css_url_image_value.cc
@@ -35,9 +35,11 @@
 }
 
 scoped_refptr<Image> CSSURLImageValue::GetSourceImageForCanvas(
-    SourceImageStatus*,
+    SourceImageStatus* status,
     const gfx::SizeF&) {
-  return GetImage();
+  scoped_refptr<Image> image = GetImage();
+  *status = image ? kNormalSourceImageStatus : kInvalidSourceImageStatus;
+  return image;
 }
 
 scoped_refptr<Image> CSSURLImageValue::GetImage() const {
diff --git a/third_party/blink/renderer/modules/canvas/canvas2d/canvas_2d_recorder_context.cc b/third_party/blink/renderer/modules/canvas/canvas2d/canvas_2d_recorder_context.cc
index 6b85db95..5528a0d 100644
--- a/third_party/blink/renderer/modules/canvas/canvas2d/canvas_2d_recorder_context.cc
+++ b/third_party/blink/renderer/modules/canvas/canvas2d/canvas_2d_recorder_context.cc
@@ -2443,7 +2443,7 @@
     return nullptr;
   }
 
-  SourceImageStatus status;
+  SourceImageStatus status = kInvalidSourceImageStatus;
 
   gfx::SizeF default_object_size(Width(), Height());
   scoped_refptr<Image> image_for_rendering =

diff --git a/third_party/blink/renderer/core/css/cssom/css_style_image_value_test.cc b/third_party/blink/renderer/core/css/cssom/css_style_image_value_test.cc
index 71cbe02..4408890 100644
--- a/third_party/blink/renderer/core/css/cssom/css_style_image_value_test.cc
+++ b/third_party/blink/renderer/core/css/cssom/css_style_image_value_test.cc
@@ -5,6 +5,9 @@
 #include "third_party/blink/renderer/core/css/cssom/css_style_image_value.h"
 
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/renderer/core/css/css_image_value.h"
+#include "third_party/blink/renderer/core/css/css_url_data.h"
+#include "third_party/blink/renderer/core/css/cssom/css_url_image_value.h"
 #include "third_party/blink/renderer/platform/graphics/image.h"
 #include "third_party/blink/renderer/platform/heap/garbage_collected.h"
 
@@ -69,4 +72,18 @@
   EXPECT_FALSE(is_null);
 }
 
+TEST(CSSURLImageValueTest, GetSourceImageForCanvasSetsStatus) {
+  auto* url_data = MakeGarbageCollected<CSSUrlData>(
+      AtomicString("https://example.com/image.png"));
+  auto* css_image_value = MakeGarbageCollected<CSSImageValue>(*url_data);
+  auto* url_image_value =
+      MakeGarbageCollected<CSSURLImageValue>(*css_image_value);
+
+  SourceImageStatus status = kNormalSourceImageStatus;
+  url_image_value->GetSourceImageForCanvas(&status, gfx::SizeF(100, 100));
+  // Since the image is not loaded, GetImage() returns null, and status should
+  // be kInvalidSourceImageStatus.
+  EXPECT_EQ(status, kInvalidSourceImageStatus);
+}
+
 }  // namespace blink