← WebKit — 2026-W36
3c0232a5d33e17eeec3db8c24e5f7bf171cf8742 CanvasNoiseInjection misclassifies the bottom-left pixel due to an off-by-one in the bottom-row check
severity medium
class OOB-read
confidence 0.65
signal score 6.3
Source/WebCore/html
patch-now
Primitive: Off-by-one bottom-row detection in canvas noise-injection neighbor indexing
Triage note: CanvasNoiseInjection::boundingNeighbors changes isInBottomRow from pixelIndex > (height-1)*width to >=; with > the first pixel of the last row was treated as interior, so neighbor indices in the (nonexistent) row below read past the pixel buffer. Reachable via canvas noise injection on attacker-sized canvases.
Triage note: CanvasNoiseInjection::boundingNeighbors changes isInBottomRow from pixelIndex > (height-1)*width to >=; with > the first pixel of the last row was treated as interior, so neighbor indices in the (nonexistent) row below read past the pixel buffer. Reachable via canvas noise injection on attacker-sized canvases.
Structural signals: msg_strong (+3.0), area:Source/WebCore/html (+2.0), surgical (+1.3)
Commit message
CanvasNoiseInjection misclassifies the bottom-left pixel due to an off-by-one in the bottom-row check
https://bugs.webkit.org/show_bug.cgi?id=323405
rdar://186640624
Reviewed by Gerald Squelart.
boundingNeighbors() classifies the bottom row with
pixelIndex > (size.height() - 1) * size.width()
but the last row spans indices [(H-1)*W, H*W-1], so the test should be
">=". With ">", the bottom-left pixel (pixelIndex == (H-1)*W) is not
recognized as being in the bottom row, and consequently not recognized
as the bottom-left corner. The top-row check on the line above already
uses the correct "<" form; this makes the bottom-row check symmetric.
This has no observable effect on output: the misclassified pixel falls
into the left-column branch, whose below-neighbor is out of bounds, so
areColorsRelated() returns false and the bounding colors stay at their
defaults -- identical to what the corner early-return produces. It also
does not trip the isIndexInBounds() assertion, because the out-of-bounds
below-index equals bufferSize exactly and the "+ 3" probe is
short-circuited. This is a correctness/clarity fix; no test is added
because the pixel output is byte-for-byte unchanged and any test would
pass without the fix.
* Source/WebCore/html/CanvasNoiseInjection.cpp:
(WebCore::boundingNeighbors):
Canonical link: https://commits.webkit.org/320510@main
Before / after
Loading diff…
On This Page