[Webkit-unassigned] [Bug 164617] New: [iOS] Crash because of passing freed CFDictionaryRef to CG when decoding a sub-sampled large image

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=164617

            Bug ID: 164617
           Summary: [iOS] Crash because of passing freed CFDictionaryRef
                    to CG when decoding a sub-sampled large image
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Images
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: sabouhallawa at apple.com

On iOS image sub-sampling is enabled by default, WebCore::imageSourceOptions() creates a new dictionary for the image options every time it is called.

Because ImageDecoder::createFrameImageAtIndex() takes the raw pointer of the output of imageSourceOptions(), CFRelease() is called for the returned retain pointer. This happens immediately after assigning the raw pointer to the local variable.  This causes the CFDictionaryRef to be freed before passing it to CGImageSourceCreateImageAtIndex().

    CFDictionaryRef options = imageSourceOptions(subsamplingLevel, decodingMode).get();
    RetainPtr<CGImageRef> image = adoptCF(CGImageSourceCreateImageAtIndex(m_nativeDecoder.get(), index, options));

The original code was not getting the raw pointer into a local variable. Instead it was passing it directly to  CGImageSourceCreateImageAtIndex(). This prevents calling CFRelease() before CGImageSourceCreateImageAtIndex returns.

    RetainPtr<CGImageRef> image = adoptCF(CGImageSourceCreateImageAtIndex(m_nativeDecoder.get(), index, imageSourceOptions(subsamplingLevel).get()));

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20161110/ea7956cc/attachment.html>