Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 24545f4fcbd7c5ed088348ec64e7e039da43eb00
https://github.com/WebKit/WebKit/commit/24545f4fcbd7c5ed088348ec64e7e039da43eb00
Author: Justin Michaud <[email protected]>
Date: 2026-08-29 (Sat, 29 Aug 2026)
Changed paths:
M LayoutTests/fast/images/animated-image-mp4-crash.html
A LayoutTests/fast/images/apng-acTL-frame-count-overflow-expected.txt
A LayoutTests/fast/images/apng-acTL-frame-count-overflow.html
A LayoutTests/fast/images/apng-acTL-zero-frame-count-expected.txt
A LayoutTests/fast/images/apng-acTL-zero-frame-count.html
A
LayoutTests/fast/images/apng-decode-after-frame-cache-eviction-expected.txt
A LayoutTests/fast/images/apng-decode-after-frame-cache-eviction.html
A LayoutTests/fast/images/resources/apng-acTL-frame-count-overflow.png
A LayoutTests/fast/images/resources/apng-acTL-zero-frame-count.png
A LayoutTests/fast/images/resources/apng-frame-cache-eviction.png
A
LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash-expected.txt
A LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash.html
A LayoutTests/http/tests/images/resources/ico-png-subimage.ico
M LayoutTests/platform/ios/TestExpectations
M LayoutTests/platform/mac/TestExpectations
M Source/WebCore/platform/graphics/ImageBackingStore.h
M Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp
M Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp
M Source/WebCore/platform/image-decoders/jpegxl/JPEGXLImageDecoder.cpp
M Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
M Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp
M Source/WebCore/testing/Internals.cpp
M Source/WebCore/testing/Internals.h
M Source/WebCore/testing/Internals.idl
M Tools/TestWebKitAPI/PlatformGTK.cmake
M Tools/TestWebKitAPI/PlatformWPE.cmake
A Tools/TestWebKitAPI/Tests/WebCore/ImageDecoderTests.cpp
Log Message:
-----------
[non-cocoa][fuzz] Frame cache evicted or unparsed frames dereferenced
https://bugs.webkit.org/show_bug.cgi?id=321756
Reviewed by Claudio Saavedra.
Add some helpers to test the various image decoders.
Fix:
- PNGImageDecoder::readChunks() stored the acTL frame count before validating
it, so a malformed APNG could advertise up to 2^32 - 1 frames through
frameCount() while the frame buffer cache held a single entry.
- PNGImageDecoder::initFrameBuffer() and frameComplete(), and the same
compositing logic in GIFImageDecoder::frameComplete(), read the previous
frame's backing store; a frame evicted from the frame cache has none, so
null-check it first.
- JPEGXLImageDecoder::clearDecodedPixelDataIfNeeded() built an end iterator
from clearBeforeFrame without clamping it to the cache size.
- WEBPImageDecoder::frameBufferAtIndex() blindly indexed the cache after
decode(), but decode() leaves the cache untouched when it bails out early.
- ICOImageDecoder::decodeAtIndex() dereferenced the embedded PNG sub-decoder's
firstFrameBuffer(), which can be null
* LayoutTests/fast/images/animated-image-mp4-crash.html:
* LayoutTests/fast/images/apng-acTL-frame-count-overflow-expected.txt: Added.
* LayoutTests/fast/images/apng-acTL-frame-count-overflow.html: Added.
* LayoutTests/fast/images/apng-acTL-zero-frame-count-expected.txt: Added.
* LayoutTests/fast/images/apng-acTL-zero-frame-count.html: Added.
* LayoutTests/fast/images/apng-decode-after-frame-cache-eviction-expected.txt:
Added.
* LayoutTests/fast/images/apng-decode-after-frame-cache-eviction.html: Added.
* LayoutTests/fast/images/resources/apng-acTL-frame-count-overflow.png: Added.
* LayoutTests/fast/images/resources/apng-acTL-zero-frame-count.png: Added.
* LayoutTests/fast/images/resources/apng-frame-cache-eviction.png: Added.
*
LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash-expected.txt:
Added.
* LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash.html: Added.
* LayoutTests/http/tests/images/resources/ico-png-subimage.ico: Added.
* Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp:
(WebCore::GIFImageDecoder::frameComplete):
* Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp:
(WebCore::ICOImageDecoder::decodeAtIndex):
* Source/WebCore/platform/image-decoders/jpegxl/JPEGXLImageDecoder.cpp:
(WebCore::JPEGXLImageDecoder::clearDecodedPixelDataIfNeeded):
* Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp:
(WebCore::PNGImageDecoder::frameBufferAtIndex):
(WebCore::PNGImageDecoder::readChunks):
(WebCore::PNGImageDecoder::initFrameBuffer):
(WebCore::PNGImageDecoder::frameComplete):
* Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp:
(WebCore::WEBPImageDecoder::frameBufferAtIndex):
* Source/WebCore/testing/Internals.cpp:
(WebCore::Internals::forceDecodeImageFrameAtIndex):
* Source/WebCore/testing/Internals.h:
* Source/WebCore/testing/Internals.idl:
* Tools/TestWebKitAPI/PlatformGTK.cmake:
* Tools/TestWebKitAPI/PlatformWPE.cmake:
* Tools/TestWebKitAPI/Tests/WebCore/ImageDecoderTests.cpp: Added.
(TestWebKitAPI::append32):
(TestWebKitAPI::crc32For):
(TestWebKitAPI::appendChunk):
(TestWebKitAPI::redScanlines):
(TestWebKitAPI::storedZlibStream):
(TestWebKitAPI::makeAnimatedPNG):
(TestWebKitAPI::makeTwoFrameAPNG):
(TestWebKitAPI::createDecoder):
(TestWebKitAPI::TEST(ImageDecoder, APNGRejectedFrameCountIsNotReported)):
(TestWebKitAPI::TEST(ImageDecoder, APNGZeroFrameCountStillDecodesDefaultImage)):
(TestWebKitAPI::TEST(ImageDecoder, APNGValidFrameCountIsReported)):
(TestWebKitAPI::TEST(ImageDecoder, ClearFrameBufferCacheThenDecodeAgain)):
(TestWebKitAPI::TEST(ImageDecoder, FrameIndexPastEndIsHandled)):
(TestWebKitAPI::TEST(ImageDecoder, PartialDataThenFullData)):
(TestWebKitAPI::makeICOWithPNGSubImage):
(TestWebKitAPI::TEST(ImageDecoder, ICOWithPartiallyReceivedPNGSubImage)):
* LayoutTests/platform/ios/TestExpectations:
* LayoutTests/platform/mac/TestExpectations:
Canonical link: https://commits.webkit.org/320102@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
