RESOLVED FIXED 15104
GIFImageDecoder.cpp buffer overrun prevention bug 
https://bugs.webkit.org/show_bug.cgi?id=15104
Summary GIFImageDecoder.cpp buffer overrun prevention bug
Peter Kasting
Reported 2007-08-28 14:48:59 PDT
GIFImageDecoder.cpp (not used by Safari, but used by Cairo/QT) has a bug in some buffer overflow prevention code that results in the frame buffer never being written for rows near the bottom of some interlaced GIFs (resulting in either nothing or garbage showing up for those rows). Specifically, the repeated rows code in haveDecodedRow() double-compensates for sizeof(unsigned) in its buffer overrun check, by adding a pre-multiplied scalar to a pointer (which causes the compiler to multiply it again). Patch coming shortly.
Attachments
patch v1 (1.75 KB, patch)
2007-08-28 15:09 PDT, Peter Kasting 		mjs: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Peter Kasting
Comment 1 2007-08-28 15:09:54 PDT
Created attachment 16148 [details] patch v1 Simple fix.
Maciej Stachowiak
Comment 2 2007-08-28 20:26:51 PDT
Comment on attachment 16148 [details] patch v1 r=me It might also be helpful to provide a test case of a bad gif like this.
Mark Rowe (bdash)
Comment 3 2007-08-29 10:36:21 PDT
Landed in r25293. Peter, can you please be sure to use spaces rather than tabs for indentation in your ChangeLog entries? Thanks! :)
Note You need to log in before you can comment on or make changes to this bug.