Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: ad76efc28c94b953cd281632e2a31142ce81d106
https://github.com/WebKit/WebKit/commit/ad76efc28c94b953cd281632e2a31142ce81d106
Author: Justin Michaud <[email protected]>
Date: 2026-09-03 (Thu, 03 Sep 2026)
Changed paths:
M LayoutTests/fast/images/animated-image-mp4-crash.html
A LayoutTests/fast/images/apng-acTL-frame-count-overflow-expected.txt
A LayoutTests/fast/images/apng-acTL-frame-count-overflow.html
A LayoutTests/fast/images/apng-acTL-zero-frame-count-expected.txt
A LayoutTests/fast/images/apng-acTL-zero-frame-count.html
A
LayoutTests/fast/images/apng-decode-after-frame-cache-eviction-expected.txt
A LayoutTests/fast/images/apng-decode-after-frame-cache-eviction.html
A LayoutTests/fast/images/resources/apng-acTL-frame-count-overflow.png
A LayoutTests/fast/images/resources/apng-acTL-zero-frame-count.png
A
LayoutTests/fast/images/resources/apng-frame-cache-eviction.png
A
LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash-expected.txt
A LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash.html
A LayoutTests/http/tests/images/resources/ico-png-subimage.ico
M LayoutTests/platform/ios/TestExpectations
M LayoutTests/platform/mac/TestExpectations
M Source/WebCore/platform/graphics/ImageBackingStore.h
M Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp
M Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp
M Source/WebCore/platform/image-decoders/jpegxl/JPEGXLImageDecoder.cpp
M Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
M Source/WebCore/platform/image-decoders/png/PNGImageDecoder.h
M Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp
M Source/WebCore/testing/Internals.cpp
M Source/WebCore/testing/Internals.h
M
Source/WebCore/testing/Internals.idl
M Tools/TestWebKitAPI/PlatformGTK.cmake
M Tools/TestWebKitAPI/PlatformWPE.cmake
A Tools/TestWebKitAPI/Tests/WebCore/ImageDecoderTests.cpp
Log Message:
-----------
Cherry-pick 320102@main (24545f4fcbd7).
https://bugs.webkit.org/show_bug.cgi?id=321756
[non-cocoa][fuzz] Frame cache evicted or unparsed frames dereferenced
https://bugs.webkit.org/show_bug.cgi?id=321756
Reviewed by Claudio Saavedra.
Add some helpers to test the various image decoders.
Fix:
- PNGImageDecoder::readChunks() stored the acTL frame count before
validating
it, so a malformed APNG could advertise up to 2^32 - 1 frames through
frameCount() while the frame buffer cache held a single entry.
- PNGImageDecoder::initFrameBuffer() and frameComplete(), and the same
compositing logic in GIFImageDecoder::frameComplete(), read the previous
frame's backing store; a frame evicted from the
frame
cache has none, so
null-check it first.
- JPEGXLImageDecoder::clearDecodedPixelDataIfNeeded() built an end iterator
from clearBeforeFrame without clamping it to the cache size.
- WEBPImageDecoder::frameBufferAtIndex() blindly indexed the cache after
decode(), but decode() leaves the cache untouched when it bails out early.
- ICOImageDecoder::decodeAtIndex() dereferenced the embedded PNG
sub-decoder's
firstFrameBuffer(), which can be null
* LayoutTests/fast/images/animated-image-mp4-crash.html:
* LayoutTests/fast/images/apng-acTL-frame-count-overflow-expected.txt:
Added.
* LayoutTests/fast/images/apng-acTL-frame-count-overflow.html: Added.
* LayoutTests/fast/images/apng-acTL-zero-frame-count-expected.txt: Added.
* LayoutTests/fast/images/apng-acTL-zero-frame-count.html: Added.
*
LayoutTests/fast/images/apng-decode-after-frame-cache-eviction-expected.txt:
Added.
*
LayoutTests/fast/images/apng-decode-after-frame-cache-eviction.html: Added.
* LayoutTests/fast/images/resources/apng-acTL-frame-count-overflow.png:
Added.
* LayoutTests/fast/images/resources/apng-acTL-zero-frame-count.png: Added.
* LayoutTests/fast/images/resources/apng-frame-cache-eviction.png: Added.
*
LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash-expected.txt:
Added.
* LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash.html:
Added.
* LayoutTests/http/tests/images/resources/ico-png-subimage.ico: Added.
* Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp:
(WebCore::GIFImageDecoder::frameComplete):
* Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp:
(WebCore::ICOImageDecoder::decodeAtIndex):
* Source/WebCore/platform/image-decoders/jpegxl/JPEGXLImageDecoder.cpp:
(WebCore::JPEGXLImageDecoder::clearDecodedPixelDataIfNeeded):
*
Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp:
(WebCore::PNGImageDecoder::frameBufferAtIndex):
(WebCore::PNGImageDecoder::readChunks):
(WebCore::PNGImageDecoder::initFrameBuffer):
(WebCore::PNGImageDecoder::frameComplete):
* Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp:
(WebCore::WEBPImageDecoder::frameBufferAtIndex):
* Source/WebCore/testing/Internals.cpp:
(WebCore::Internals::forceDecodeImageFrameAtIndex):
* Source/WebCore/testing/Internals.h:
* Source/WebCore/testing/Internals.idl:
* Tools/TestWebKitAPI/PlatformGTK.cmake:
* Tools/TestWebKitAPI/PlatformWPE.cmake:
* Tools/TestWebKitAPI/Tests/WebCore/ImageDecoderTests.cpp: Added.
(TestWebKitAPI::append32):
(TestWebKitAPI::crc32For):
(TestWebKitAPI::appendChunk):
(TestWebKitAPI::redScanlines):
(TestWebKitAPI::storedZlibStream):
(TestWebKitAPI::makeAnimatedPNG):
(TestWebKitAPI::makeTwoFrameAPNG):
(TestWebKitAPI::createDecoder):
(TestWebKitAPI::TEST(ImageDecoder, APNGRejectedFrameCountIsNotReported)):
(TestWebKitAPI::TEST(ImageDecoder,
APNGZeroFrameCountStillDecodesDefaultImage)):
(TestWebKitAPI::TEST(ImageDecoder, APNGValidFrameCountIsReported)):
(TestWebKitAPI::TEST(ImageDecoder, ClearFrameBufferCacheThenDecodeAgain)):
(TestWebKitAPI::TEST(ImageDecoder, FrameIndexPastEndIsHandled)):
(TestWebKitAPI::TEST(ImageDecoder, PartialDataThenFullData)):
(TestWebKitAPI::makeICOWithPNGSubImage):
(TestWebKitAPI::TEST(ImageDecoder, ICOWithPartiallyReceivedPNGSubImage)):
* LayoutTests/platform/ios/TestExpectations:
* LayoutTests/platform/mac/TestExpectations:
Canonical link:
https://flagged.apple.com:443/proxy?t2=Do6y4m0xX5&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzIwMTAyQG1haW4=&emid=dcec17e9-e57f-42d3-98da-4de32646a47d&c=11
Canonical link:
https://flagged.apple.com:443/proxy?t2=Df7R7d0Ti7&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzA1ODc3LjExMzhAd2Via2l0Z2xpYi8yLjUy&emid=dcec17e9-e57f-42d3-98da-4de32646a47d&c=11
To unsubscribe from these emails, change your
notification settings at https://github.com/WebKit/WebKit/settings/notifications
