Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e513b5fcd8573e7226108b3bb1caca5b21d92dd6
https://github.com/WebKit/WebKit/commit/e513b5fcd8573e7226108b3bb1caca5b21d92dd6
Author: Justin Michaud <[email protected]>
Date: 2026-09-04 (Fri, 04 Sep 2026)
Changed paths:
A LayoutTests/fast/images/gif-frame-outside-logical-screen-expected.txt
A LayoutTests/fast/images/gif-frame-outside-logical-screen.html
A LayoutTests/fast/images/resources/gif-frame-outside-logical-screen.gif
M Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp
Log Message:
-----------
[non-cocoa][fuzz] GIF image decoder should not have negative width/height
https://bugs.webkit.org/show_bug.cgi?id=321752
Reviewed by Patrick Griffis and Claudio Saavedra.
GIFImageDecoder::initFrameBuffer() clamped a frame rect that extends past the
canvas by subtracting the frame's offset from the canvas extent. A GIF's logical
screen size is only published for the first frame, so a later frame's offset can
itself be past the canvas, which made that subtraction negative and left the
backing store with a frame rect of negative width or height. Intersect with the
canvas instead, which clamps to an empty rect.
* LayoutTests/fast/images/gif-frame-outside-logical-screen-expected.txt: Added.
* LayoutTests/fast/images/gif-frame-outside-logical-screen.html: Added.
* LayoutTests/fast/images/resources/gif-frame-outside-logical-screen.gif: Added.
* Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp:
(WebCore::GIFImageDecoder::initFrameBuffer):
Canonical link: https://commits.webkit.org/320531@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
