Bug 15104 - GIFImageDecoder.cpp buffer overrun prevention bug
Summary: GIFImageDecoder.cpp buffer overrun prevention bug
Alias: None
Product: WebKit
Classification: Unclassified
Component: Images (show other bugs)
Version: 523.x (Safari 3)
Hardware: PC All
: P2 Normal
Assignee: Nobody
Depends on:
Reported: 2007-08-28 14:48 PDT by Peter Kasting
Modified: 2007-08-29 10:36 PDT (History)
0 users

See Also:

patch v1 (1.75 KB, patch)
2007-08-28 15:09 PDT, Peter Kasting
mjs: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Peter Kasting 2007-08-28 14:48:59 PDT
GIFImageDecoder.cpp (not used by Safari, but used by Cairo/QT) has a bug in some buffer overflow prevention code that results in the frame buffer never being written for rows near the bottom of some interlaced GIFs (resulting in either nothing or garbage showing up for those rows).

Specifically, the repeated rows code in haveDecodedRow() double-compensates for sizeof(unsigned) in its buffer overrun check, by adding a pre-multiplied scalar to a pointer (which causes the compiler to multiply it again).

Patch coming shortly.
Comment 1 Peter Kasting 2007-08-28 15:09:54 PDT
Created attachment 16148 [details]
patch v1

Simple fix.
Comment 2 Maciej Stachowiak 2007-08-28 20:26:51 PDT
Comment on attachment 16148 [details]
patch v1


It might also be helpful to provide a test case of a bad gif like this.
Comment 3 Mark Rowe (bdash) 2007-08-29 10:36:21 PDT
Landed in r25293.  Peter, can you please be sure to use spaces rather than tabs for indentation in your ChangeLog entries?  Thanks! :)