15909 2007-11-08 15:44:26 -0800 Public GIF image decoder can (still) corrupt memory on malformed GIFs 2007-11-09 04:54:16 -0800 1 1 1 Unclassified WebKit Images 528+ (Nightly build) PC All RESOLVED FIXED P2 Normal --- 0 pkasting webkit-unassigned oldest_to_newest 60695 0 pkasting 2007-11-08 15:44:26 -0800 Follow-on bug to bug 15778. My original patch had an oversight; I didn't catch the case where an image had an excessively large frame with a nonzero Y-offset, which could still have caused a fault. Simple patch coming shortly. 60702 1 17133 pkasting 2007-11-08 16:00:00 -0800 Created attachment 17133 patch v1 Easy fix. 60714 2 17133 mrowe 2007-11-08 17:58:03 -0800 Comment on attachment 17133 patch v1 r=me 60760 3 mrowe 2007-11-09 04:54:16 -0800 Landed in r27642. 17133 2007-11-08 16:00:00 -0800 2007-11-08 17:58:03 -0800 patch v1 patch text/plain 1334 pkasting SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiAyNzYxOSkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTMgQEAKKzIwMDctMTEtMDggIFBldGVyIEthc3RpbmcgIDx6ZXJvZHB4QGdtYWls LmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBo dHRwOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTkwOQorICAgICAgICBNYWxm b3JtZWQgR0lGcyBzaG91bGQgbm90IHJlc3VsdCBpbiBtZW1vcnkgY29ycnVwdGlvbi4KKworICAg ICAgICAqIHBsYXRmb3JtL2ltYWdlLWRlY29kZXJzL2dpZi9HSUZJbWFnZURlY29kZXIuY3BwOgor ICAgICAgICAoV2ViQ29yZTo6R0lGSW1hZ2VEZWNvZGVyOjpoYXZlRGVjb2RlZFJvdyk6CisKIDIw MDctMTEtMDggIFN0ZXZlIEZhbGtlbmJ1cmcgIDxzZmFsa2VuQGFwcGxlLmNvbT4KIAogICAgICAg ICA8cmRhcjovL3Byb2JsZW0vNTUyNDA4Mj4gQWxsb3cgaW1hZ2VzIHRvIGJlIGRyYWdnZWQgb3V0 IGRpcmVjdGx5IGludG8gb3RoZXIgYXBwcwpJbmRleDogV2ViQ29yZS9wbGF0Zm9ybS9pbWFnZS1k ZWNvZGVycy9naWYvR0lGSW1hZ2VEZWNvZGVyLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJDb3JlL3Bs YXRmb3JtL2ltYWdlLWRlY29kZXJzL2dpZi9HSUZJbWFnZURlY29kZXIuY3BwCShyZXZpc2lvbiAy NzYxOCkKKysrIFdlYkNvcmUvcGxhdGZvcm0vaW1hZ2UtZGVjb2RlcnMvZ2lmL0dJRkltYWdlRGVj b2Rlci5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTI5OSw3ICsyOTksNyBAQCB2b2lkIEdJRkltYWdl RGVjb2Rlcjo6aGF2ZURlY29kZWRSb3codW5zCiAgICAgICAgIGluaXRGcmFtZUJ1ZmZlcihidWZm ZXIsIHByZXZpb3VzQnVmZmVyLCBjb21wb3NpdGVXaXRoUHJldmlvdXNGcmFtZSk7CiAKICAgICAv LyBEbyBub3RoaW5nIGZvciBib2d1cyBkYXRhLgotICAgIGlmIChyb3dCdWZmZXIgPT0gMCB8fCBz dGF0aWNfY2FzdDxpbnQ+KHJvd051bWJlcikgPj0gbV9zaXplLmhlaWdodCgpKQorICAgIGlmIChy b3dCdWZmZXIgPT0gMCB8fCBzdGF0aWNfY2FzdDxpbnQ+KG1fcmVhZGVyLT5mcmFtZVlPZmZzZXQo KSArIHJvd051bWJlcikgPj0gbV9zaXplLmhlaWdodCgpKQogICAgICAgcmV0dXJuOwogCiAgICAg dW5zaWduZWQgY29sb3JNYXBTaXplOwo=