IntegerOverflow
24 commits
Integer wraparound as the root cause — even when it later manifests as OOB.
2026-W39 2026-09-26 – 10-02
- Harden Biquad and IIRFilter getFrequencyResponse() by removing the caller-sized temporary Vector
2026-W36 2026-09-05 – 11
2026-W35 2026-08-29 – 09-04
- [JSC] YarrJIT non-BMP backtrack trampoline (L>F branch) does not add firstCharacterAdditionalReadSize to index, returns start > end
2026-W34 2026-08-22 – 28
- int truncation of OBU size in RtpPacketizerAv1::ParseObus
- [JSC] Pin upstream checks that DFG IRO range proofs rely on
- Handle overflows in UnlinkedMetadataTable::finalize().
- [WebCore] Memory underflow in PlatformRawAudioData::copyTo()
- [JSC] NodeMustGenerate incorrectly cleared on CheckOverflow ArithAdd/ArithSub in DFGFixupPhase Inc/Dec handler
2026-W31 2026-08-01 – 07
2026-W26 2026-06-27 – 07-03
- ExpressionInfo::Encoder computes the offset to Extension Islands incorrectly.
- Change IPInt m_pendingOffset to std::optional and add metadata offset overflow assertions
- uint32 Wraparound in vsUintIndexClamp Leads to GPU OOB Read
- Add size limit to Yarr generated code
- [WebGPU] signed-negation overflow on baseVertex==INT32_MIN in RenderPassEncoder::clampIndexBufferToValidValues
- MockSampleBox should not have negative timeScales and duration
2026-W24 2026-06-13 – 19
2026-W23 2026-06-06 – 12
- Undefined left-shift in AV1 readULEBSize()
2026-W22 2026-05-30 – 06-05
2026-W21 2026-05-23 – 29
- Integer underflow leads to crash in ComputeH264InfoFromAVC