Bug 22885

Summary: Memory corruption in GIFImageDecoder.cpp
Product: WebKit Reporter: Peter Kasting <pkasting>
Component: ImagesAssignee: Peter Kasting <pkasting>
Status: RESOLVED FIXED    
Severity: Normal    
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: All   
URL: http://img.waffleimages.com/9d5247a3e6a95c2966c0c5f34b47a7837309f2af/lolchrome.gif
Attachments:
Description Flags
patch v1 hyatt: review+

Peter Kasting
Reported 2008-12-16 13:37:57 PST
GIFImageDecoder.cpp (which is not used by Safari, but is used by the Cairo port, and is related to the code used by Chromium) has a memory corruption bug with GIFs which insert empty frames, like the one given above. The fix is to ensure frames get initialized even if we never call haveDecodedRow(). Patch coming shortly.
Attachments
patch v1 (1.50 KB, patch)
2008-12-16 13:40 PST, Peter Kasting 		hyatt: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Peter Kasting
Comment 1 2008-12-16 13:40:32 PST
Created attachment 26066 [details] patch v1
Dave Hyatt
Comment 2 2008-12-16 13:41:39 PST
Comment on attachment 26066 [details] patch v1 r=me
Peter Kasting
Comment 3 2008-12-16 13:44:42 PST
Fixed in r39340.
Note You need to log in before you can comment on or make changes to this bug.