Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 0f857107ffab578c2c25cb74afd5c68e22fc3a33
https://github.com/WebKit/WebKit/commit/0f857107ffab578c2c25cb74afd5c68e22fc3a33
Author: Said Abou-Hallawa <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
M Source/WebCore/platform/graphics/DestinationColorSpace.cpp
M Source/WebCore/platform/graphics/DestinationColorSpace.h
M Source/WebCore/platform/graphics/PixelBufferConversion.cpp
M Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in
M Source/WebKit/Shared/WebCoreArgumentCodersPlatform.serialization.in
M Tools/TestWebKitAPI/Tests/WebCore/ImageBufferTests.cpp
Log Message:
-----------
GetPixelBuffer should zeroFill the destination if any error happens
https://bugs.webkit.org/show_bug.cgi?id=312945
rdar://174640273
Reviewed by Kimmo Kinnunen.
RemoteImageBuffer fails to GetPixelBuffer if the destination colorSpace is
non-RGB
model (e.g. kCGColorSpaceGenericCMYK). In this case the PixelBuffer is allocated
but never be initialized. So stale heap can be exposed to callers.
To fix this an IPC validator is needed to ensure the colorSpace is indeed RGB
model.
And to handle other possible unknown failures, the destination PixelBuffer will
be zero-filled if vImage fails to do the conversion the colorSpace conversion.
* Source/WebCore/platform/graphics/DestinationColorSpace.cpp:
(WebCore::DestinationColorSpace::usesRGBColorModel const):
* Source/WebCore/platform/graphics/DestinationColorSpace.h:
* Source/WebCore/platform/graphics/PixelBufferConversion.cpp:
(WebCore::convertImagePixelsAccelerated):
* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:
* Tools/TestWebKitAPI/Tests/WebCore/ImageBufferTests.cpp:
(TestWebKitAPI::TEST(ImageBufferTests, GetPixelBufferAllZeros)):
Originally-landed-as: 305413.874@safari-7624-branch (8e2784fd0807).
rdar://180429216
* Source/WebKit/Shared/WebCoreArgumentCodersPlatform.serialization.in:
Canonical link: https://commits.webkit.org/316159@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
