Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: bac831839b44a3b0decec3b1f2ac38f33c730e2e
https://github.com/WebKit/WebKit/commit/bac831839b44a3b0decec3b1f2ac38f33c730e2e
Author: Ahmad Saleem <[email protected]>
Date: 2026-09-14 (Mon, 14 Sep 2026)
Changed paths:
M
Source/WebCore/platform/graphics/filters/software/FEGaussianBlurSoftwareApplier.cpp
Log Message:
-----------
FEGaussianBlurSoftwareApplier ignores vImage errors by storing them in size_t
https://bugs.webkit.org/show_bug.cgi?id=324107
rdar://187322835
Reviewed by Said Abou-Hallawa.
In boxBlurAccelerated(), the temp-buffer size query calls
vImageBoxConvolve_ARGB8888() with kvImageGetTempBufferSize, which returns
either the required size (positive) or a vImage_Error (negative). The
result was stored in a size_t, so a negative error code wrapped to a huge
unsigned value. The subsequent `tmpBufferSize <= 0` guard, evaluated on an
unsigned type, can only ever be true for exactly 0 and never catches the
error, letting the wrapped value flow into fastMalloc() as an enormous
allocation request.
Store the result using auto, which deduces the function's signed
vImage_Error return type, so the <= 0 check correctly rejects both error
codes and a zero size before the allocation. The value is guaranteed
positive at the fastMalloc() call, so the conversion to size_t is safe.
*
Source/WebCore/platform/graphics/filters/software/FEGaussianBlurSoftwareApplier.cpp:
(WebCore::FEGaussianBlurSoftwareApplier::boxBlurAccelerated):
Canonical link: https://commits.webkit.org/321123@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
