Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e269e1967d8d2dd0d4b1ba8bedd38900a46b6102
https://github.com/WebKit/WebKit/commit/e269e1967d8d2dd0d4b1ba8bedd38900a46b6102
Author: Sabith Saheb <[email protected]>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
A LayoutTests/fast/images/bmp-rle24-absolute-run-crash-expected.txt
A LayoutTests/fast/images/bmp-rle24-absolute-run-crash.html
A LayoutTests/fast/images/resources/bmp-rle24-absolute-run-crash.bmp
M Source/WebCore/platform/image-decoders/bmp/BMPImageReader.cpp
M Source/WebCore/platform/image-decoders/bmp/BMPImageReader.h
Log Message:
-----------
Out-of-bounds read in BMP RLE24 absolute-mode decoding
https://bugs.webkit.org/show_bug.cgi?id=321680
Reviewed by Michael Catanzaro.
processNonRLEData() reuses readCurrentPixel() to decode RLE24 absolute-mode
runs, but readCurrentPixel() derives its byte offset from the absolute column
(m_coord.x() * bytesPerPixel), assuming m_decodedOffset points at the start of
the row. That holds for non-RLE rows, which always begin at column 0, but an
RLE absolute run can begin mid-row after an encoded run advanced the column
through fillRGBA(). There m_decodedOffset points at the run's pixel bytes, so
each read lands startX * 3 bytes too far. The InsufficientData check only
reserves paddedNumBytes for the run length, so a truncated RLE24 bitmap whose
absolute run starts at a non-zero column reads past the end of the
SharedBuffer.
Read run-relative instead, matching the paletted RLE8/RLE4 branch which already
indexes from the start of the run. Since readCurrentPixel() has a single caller
and its offset now depends on where the block being decoded started, move it
out of the header and into processNonRLEData() as a local lambda. The non-RLE
path is unaffected because its rows start at column 0.
Added a regression test that decodes a truncated OS/2 RLE24 BMP whose
absolute-mode run begins at a non-zero column. Because the reads are backed by
std::span, the old code took a guaranteed out-of-bounds read (and crash) on
this input; with the fix the reads stay inside the run and decoding fails
cleanly instead.
* Source/WebCore/platform/image-decoders/bmp/BMPImageReader.cpp:
(WebCore::BMPImageReader::processNonRLEData):
* Source/WebCore/platform/image-decoders/bmp/BMPImageReader.h:
(WebCore::BMPImageReader::readCurrentPixel): Deleted.
* LayoutTests/fast/images/bmp-rle24-absolute-run-crash.html: Added.
* LayoutTests/fast/images/bmp-rle24-absolute-run-crash-expected.txt: Added.
* LayoutTests/fast/images/resources/bmp-rle24-absolute-run-crash.bmp: Added.
Canonical link: https://commits.webkit.org/319523@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
