Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d3cffddf149e0bcfbf135ddd233c66cf0caf4f97
https://github.com/WebKit/WebKit/commit/d3cffddf149e0bcfbf135ddd233c66cf0caf4f97
Author: Said Abou-Hallawa <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
M
Source/WebCore/platform/graphics/filters/software/FEGaussianBlurSoftwareApplier.cpp
Log Message:
-----------
Uninitialized result of FEGaussianBlur if the input isAlphaImage
https://bugs.webkit.org/show_bug.cgi?id=314345
rdar://175674593
Reviewed by Simon Fraser.
`FEGaussianBlurSoftwareApplier::apply()` creates uninitialized `tempBuffer`
through `createScratchPixelBuffer()`.
-- If the stdDeviation of feGaussianBlur is asymmetric, e.g. "5 0", then
applying
this filter falls back to `boxBlurUnaccelerated()`.
-- If the input of feGaussianBlur isAlphaImage, e.g.
feColorMatrix(luminanceToAlpha),
then `boxBlur()` short-circuits to `boxBlurAlphaOnly()`, which writes only
the alpha channel of each pixel.
-- If one of the stdDeviation is zero, e.g. "5 0", `boxBlurUnaccelerated()` will
copy the `tempBuffer` to the `destinationPixelBuffer` with three
uninitialized
channels before it returns.
If isAlphaImage is true Make sure `tempBuffer` is zero-filled.
*
Source/WebCore/platform/graphics/filters/software/FEGaussianBlurSoftwareApplier.cpp:
(WebCore::FEGaussianBlurSoftwareApplier::boxBlurGeneric):
Originally-landed-as: 305413.858@safari-7624-branch (96b0a368415e).
rdar://180437556
Canonical link: https://commits.webkit.org/316153@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
