[Webkit-unassigned] [Bug 80754] New: [CRASH]gif imagebuffer crash in cairo platform

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=80754

           Summary: [CRASH]gif imagebuffer crash in cairo platform
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: UNCONFIRMED
          Severity: Critical
          Priority: P1
         Component: Images
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: ssseintr2 at gmail.com


In ImageDecoderCairo.cpp:
 RGBA32Buffer::asNewNativeImage() call cairo_image_surface_create_for_data().
 cairo_image_surface_create_for_data() do not copy the data to use,but hold the pointer to access.That will cause the crash happen.  GIFImageDecoder::frameCount() will call m_frameBufferCache.resize(reader.images_count),that will cause the data of the cairo_image_surface_create_for_data() holding be invalid.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.