|Summary:||GIFImageDecoder.cpp buffer overrun prevention bug|
|Product:||WebKit||Reporter:||Peter Kasting <pkasting>|
|Version:||523.x (Safari 3)|
Description Peter Kasting 2007-08-28 14:48:59 PDT
GIFImageDecoder.cpp (not used by Safari, but used by Cairo/QT) has a bug in some buffer overflow prevention code that results in the frame buffer never being written for rows near the bottom of some interlaced GIFs (resulting in either nothing or garbage showing up for those rows). Specifically, the repeated rows code in haveDecodedRow() double-compensates for sizeof(unsigned) in its buffer overrun check, by adding a pre-multiplied scalar to a pointer (which causes the compiler to multiply it again). Patch coming shortly.
Comment 1 Peter Kasting 2007-08-28 15:09:54 PDT
Created attachment 16148 [details] patch v1 Simple fix.
Comment 2 Maciej Stachowiak 2007-08-28 20:26:51 PDT
Comment on attachment 16148 [details] patch v1 r=me It might also be helpful to provide a test case of a bad gif like this.