Bug 15104

Summary: GIFImageDecoder.cpp buffer overrun prevention bug
Product: WebKit Reporter: Peter Kasting <pkasting>
Component: ImagesAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal    
Priority: P2    
Version: 523.x (Safari 3)   
Hardware: PC   
OS: All   
Attachments:
Description Flags
patch v1 mjs: review+

Description Peter Kasting 2007-08-28 14:48:59 PDT 
GIFImageDecoder.cpp (not used by Safari, but used by Cairo/QT) has a bug in some buffer overflow prevention code that results in the frame buffer never being written for rows near the bottom of some interlaced GIFs (resulting in either nothing or garbage showing up for those rows).

Specifically, the repeated rows code in haveDecodedRow() double-compensates for sizeof(unsigned) in its buffer overrun check, by adding a pre-multiplied scalar to a pointer (which causes the compiler to multiply it again).

Patch coming shortly.
Comment 1 Peter Kasting 2007-08-28 15:09:54 PDT 
Created attachment 16148 [details]
patch v1

Simple fix.
Comment 2 Maciej Stachowiak 2007-08-28 20:26:51 PDT 
Comment on attachment 16148 [details]
patch v1

r=me

It might also be helpful to provide a test case of a bad gif like this.
Comment 3 Mark Rowe (bdash) 2007-08-29 10:36:21 PDT 
Landed in r25293.  Peter, can you please be sure to use spaces rather than tabs for indentation in your ChangeLog entries?  Thanks! :)