Bug 23743 - Memory smasher in public GIFImageDecoder
Summary: Memory smasher in public GIFImageDecoder
Alias: None
Product: WebKit
Classification: Unclassified
Component: Images (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC All
: P2 Normal
Assignee: Peter Kasting
Depends on:
Reported: 2009-02-04 14:36 PST by Peter Kasting
Modified: 2009-02-04 16:00 PST (History)
0 users

See Also:

patch v1 (10.79 KB, patch)
2009-02-04 14:38 PST, Peter Kasting
hyatt: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Peter Kasting 2009-02-04 14:36:01 PST
GIFImageDecoder.cpp (both the skia and Cairo versions) has a memory smashing bug.  This doesn't affect Safari, but is a topcrash cause for the Chromium trunk.

The problem is that clearFrameBufferCache() assumes it only needs to worry about preserving the last complete frame, but initFrameBuffer() and other functions can skip over frames with a DisposeOverwritePrevious disposal method to find prior complete frames.  So the code in clearFrameBufferCache() needs to get more complex to take this into account.

Additionally, to avoid wasting more memory than we need to, RGBA32Buffer::clear() should only clear the minimum amount of metadata it needs to, because various functions will still need other data after the framebuffer itself is no longer necessary.  If we don't change clear() we'd need to clear fewer frames.

Patch coming shortly.
Comment 1 Peter Kasting 2009-02-04 14:38:31 PST
Created attachment 27329 [details]
patch v1

Note that the Cairo and Skia changes here are identical modulo the RGBA32Buffer members.  Just another reminder that I eventually need to merge these into one set of decoders.
Comment 2 Dave Hyatt 2009-02-04 15:27:24 PST
Comment on attachment 27329 [details]
patch v1

Comment 3 Peter Kasting 2009-02-04 16:00:43 PST
Fixed in r40641.