Issue 11361023: Merge 132961 (merge bug: http://crbug.com/158840) - Fix potential overflow in jpeg exif reader. Fou…

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Issue 11361023: Merge 132961 (merge bug: http://crbug.com/158840) - Fix potential overflow in jpeg exif reader. Fou… (Closed)

Created:
8 years, 1 month ago by Nico

Modified:
8 years, 1 month ago

Reviewers:
Nico

CC:
chromium-reviews

Base URL:
http://svn.webkit.org/repository/webkit/branches/chromium/1312/

Visibility:
Public.

Merge 132961 (merge bug: http://crbug.com/158840) - Fix potential overflow in jpeg exif reader. Found by aedla@google.com. https://bugs.webkit.org/show_bug.cgi?id=100320 Reviewed by Eric Seidel. Adding more than 1 element past an array is undefined, so don't do it. No test, since in practice ifd will just overflow and `end - ifd` will become much larget than 2 and the `if (end - ifd < 2)` a few lines down will catch that case. * platform/image-decoders/jpeg/JPEGImageDecoder.cpp: (WebCore::readImageOrientation): TBR=thakis@chromium.org Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=133086

Created: 8 years, 1 month ago

Download [raw] [tar.bz2]

		Unified diffs	Side-by-side diffs	Delta from patch set	Stats (+1642 lines, -1 line)			Patch
	M	Source/WebCore/ChangeLog	View		1 chunk	+1638 lines, -0 lines	0 comments	Download
	M	Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp	View		1 chunk	+4 lines, -1 line	0 comments	Download

Total messages: 1 (0 generated)