<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - [iOS] Crash because of passing freed CFDictionaryRef to CG when decoding a sub-sampled large image"
href="https://bugs.webkit.org/show_bug.cgi?id=164617">164617</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>[iOS] Crash because of passing freed CFDictionaryRef to CG when decoding a sub-sampled large image
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>WebKit Nightly Build
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>OS</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>Images
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>sabouhallawa@apple.com
</td>
</tr></table>
<p>
<div>
<pre>On iOS image sub-sampling is enabled by default, WebCore::imageSourceOptions() creates a new dictionary for the image options every time it is called.
Because ImageDecoder::createFrameImageAtIndex() takes the raw pointer of the output of imageSourceOptions(), CFRelease() is called for the returned retain pointer. This happens immediately after assigning the raw pointer to the local variable. This causes the CFDictionaryRef to be freed before passing it to CGImageSourceCreateImageAtIndex().
CFDictionaryRef options = imageSourceOptions(subsamplingLevel, decodingMode).get();
RetainPtr<CGImageRef> image = adoptCF(CGImageSourceCreateImageAtIndex(m_nativeDecoder.get(), index, options));
The original code was not getting the raw pointer into a local variable. Instead it was passing it directly to CGImageSourceCreateImageAtIndex(). This prevents calling CFRelease() before CGImageSourceCreateImageAtIndex returns.
RetainPtr<CGImageRef> image = adoptCF(CGImageSourceCreateImageAtIndex(m_nativeDecoder.get(), index, imageSourceOptions(subsamplingLevel).get()));</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>