Bug 20774
| Summary: | Crash in PNGImageDecoder::rowAvailable if bytes.resize() fails | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Alexander Mohr <amohr> |
| Component: | WebCore Misc. | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED INVALID | ||
| Severity: | Normal | CC: | webkit9, zecke |
| Priority: | P2 | ||
| Version: | 528+ (Nightly build) | ||
| Hardware: | All | ||
| OS: | All | ||
Alexander Mohr
in PNGImageDecoder.cpp, PNGImageDecoder::rowAvailable it attempts to resize the buffer to the size of the image. The issue is that if there's not enough memory bytes.resize() will faill and the buffer not be valid. This will later cause an access violation when attempting to access memory which has not been allocated.
Suggested fix after bytes.resize:
if( !bytes.data() ) {
bytes.resize(0);
return;
}
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Alexey Proskuryakov
Thanks! Would you be willing to propose this fix as described in <http://webkit.org/coding/contributing.html>?
Mike Moretti
This bug doesn't appear to be valid any more. That code is totally changed since.
Alexander Mohr
agreed, feel free to close this bug. Or if you need me to do it let me know!
Mike Moretti
I don't have access to close the bug. Thanks!
Alexander Mohr
this code has been reworked in such a way that this bug is no longer present.