Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 5b391e6d3b14d549908dad2c6695999291313f30
https://github.com/WebKit/WebKit/commit/5b391e6d3b14d549908dad2c6695999291313f30
Author: Sabith Saheb <[email protected]>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
A LayoutTests/fast/images/animated-png-icc-transform-crash-expected.txt
A LayoutTests/fast/images/animated-png-icc-transform-crash.html
A LayoutTests/fast/images/resources/animated-png-icc-transform-crash.png
M Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
Log Message:
-----------
Out-of-bounds write in PNGImageDecoder::frameComplete() ICC transform
Reviewed by Michael Catanzaro.
1. destinationRow starts at pixelsStartingAt(rect.x(), y) and the loop above
writes rect.width() pixels, but cmsDoTransform gets rect.maxX() as its pixel
count.
2. With a TYPE_BGRA_8 transform that is a 4-byte-per-pixel read-modify-write, so
once 2*rect.x() + rect.width() passes the canvas width it runs off each row,
and on the last row (yOffset + height == height) past the pixel allocation.
The only fcTL guard is xOffset + width <= width, which does not stop that;
reachable from an animated PNG with an RGB iCCP chunk on ports built with
USE(LCMS) (GTK, WPE).
Pass rect.width() so the count matches the row-relative span, like the
first-frame path in rowAvailable().
* Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp:
(WebCore::PNGImageDecoder::frameComplete):
Test: fast/images/animated-png-icc-transform-crash.html
* LayoutTests/fast/images/animated-png-icc-transform-crash.html: Added.
* LayoutTests/fast/images/animated-png-icc-transform-crash-expected.txt: Added.
* LayoutTests/fast/images/resources/animated-png-icc-transform-crash.png: Added.
Canonical link: https://commits.webkit.org/319524@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
