Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: bb98ffd5c7336141c471e359b03b57d0f6de7142
https://github.com/WebKit/WebKit/commit/bb98ffd5c7336141c471e359b03b57d0f6de7142
Author: Said Abou-Hallawa <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
M Source/WebCore/platform/graphics/cpu/arm/filters/FEBlendNeonApplier.cpp
M Source/WebCore/platform/graphics/filters/FilterImage.cpp
M Source/WebCore/platform/graphics/filters/FilterImage.h
Log Message:
-----------
FilterImage may return uninitialized PixelBuffer
https://bugs.webkit.org/show_bug.cgi?id=314906
rdar://176813834
Reviewed by Darin Adler.
FilterImage provides three different representations of the image: ImageBuffer,
Unpremultiplied PixelBuffer and Premultiplied PixelBuffer. These three buffers
are lazily created. Each of them is created only when it is needed. But keep in
mind they are copies of each other. In other words, when one is created it has
to copy the pixels from the existing buffers. Otherwise it has to be
zero-filled.
A problem may happen when copying the pixels from one buffer to a newly created
buffer fails. In this case we send uninitialized PixelBuffer which may expose
user
private data. Not able to copy existing pixels to the PixelBuffer should be
treated
as an error. So a null PixelBuffer should be returned in this case.
* Source/WebCore/platform/graphics/cpu/arm/filters/FEBlendNeonApplier.cpp:
(WebCore::FEBlendNeonApplier::apply const):
* Source/WebCore/platform/graphics/filters/FilterImage.cpp:
(WebCore::copyImageBytes):
(WebCore::FilterImage::pixelBuffer):
(WebCore::FilterImage::getPixelBuffer):
(WebCore::FilterImage::copyPixelBuffer):
* Source/WebCore/platform/graphics/filters/FilterImage.h:
Originally-landed-as: 305413.919@safari-7624-branch (dbf10417aa9e).
rdar://180436188
Canonical link: https://commits.webkit.org/316126@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
