Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 8155dfd9cd0e1860af3b5c51a397b3b0f3f44c5f
https://github.com/WebKit/WebKit/commit/8155dfd9cd0e1860af3b5c51a397b3b0f3f44c5f
Author: Justin Michaud <[email protected]>
Date: 2026-09-04 (Fri, 04 Sep 2026)
Changed paths:
A LayoutTests/fast/images/gif-frame-outside-logical-screen-expected.txt
A LayoutTests/fast/images/gif-frame-outside-logical-screen.html
A LayoutTests/fast/images/resources/gif-frame-outside-logical-screen.gif
M Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp
Log Message:
-----------
Cherry-pick 320531@main (e513b5fcd857).
https://bugs.webkit.org/show_bug.cgi?id=321752
[non-cocoa][fuzz] GIF image decoder should not have negative width/height
https://bugs.webkit.org/show_bug.cgi?id=321752
Reviewed by Patrick Griffis and Claudio Saavedra.
GIFImageDecoder::initFrameBuffer() clamped a frame rect that extends past
the
canvas by subtracting the frame's offset from the canvas extent. A GIF's
logical
screen size is only published for the first frame, so a later frame's
offset can
itself be past the canvas, which made that subtraction negative and left the
backing store with a frame rect of negative width or height. Intersect with
the
canvas instead, which clamps to an empty rect.
* LayoutTests/fast/images/gif-frame-outside-logical-screen-expected.txt:
Added.
* LayoutTests/fast/images/gif-frame-outside-logical-screen.html: Added.
* LayoutTests/fast/images/resources/gif-frame-outside-logical-screen.gif:
Added.
* Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp:
(WebCore::GIFImageDecoder::initFrameBuffer):
Canonical link: https://commits.webkit.org/320531@main
Canonical link: https://commits.webkit.org/305877.1145@webkitglib/2.52
Commit: 37c4a0953f4913b0c391311a6c249b871dedd8aa
https://github.com/WebKit/WebKit/commit/37c4a0953f4913b0c391311a6c249b871dedd8aa
Author: Justin Michaud <[email protected]>
Date: 2026-09-04 (Fri, 04 Sep 2026)
Changed paths:
A LayoutTests/fast/images/apng-hidden-first-frame-narrow-expected.txt
A LayoutTests/fast/images/apng-hidden-first-frame-narrow.html
A LayoutTests/fast/images/apng-hidden-first-frame-offset-expected.txt
A LayoutTests/fast/images/apng-hidden-first-frame-offset.html
A LayoutTests/fast/images/resources/apng-hidden-first-frame-narrow.png
A LayoutTests/fast/images/resources/apng-hidden-first-frame-offset.png
M Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
M Source/WebCore/platform/image-decoders/png/PNGImageDecoder.h
Log Message:
-----------
Cherry-pick 320270@main (56c0a88ac8c4).
https://bugs.webkit.org/show_bug.cgi?id=321753
[non-cocoa][fuzz] OOB read in APNG with hidden default image
https://bugs.webkit.org/show_bug.cgi?id=321753
Reviewed by Claudio Saavedra.
Simplify the lifecycle of the libpng callbacks so that we
don't confuse frames and read more pixels than we should.
Canonical link: https://commits.webkit.org/320270@main
Canonical link: https://commits.webkit.org/305877.1146@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/99f7cbec1ad4...37c4a0953f49
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
