OOB
49 commits
Out-of-bounds read or write, buffer overflow, missing bounds check.
2026-W36 2026-09-05 – 11
2026-W35 2026-08-29 – 09-04
- [JSC] Validate RegExps in DFG strength reduction phase
- ANGLE: Element limit not updated after format only VertexAttribPointer change
- [WebGL] Reject offset-based GL calls when no buffer is bound
- IOSurfacePool::tryEvictOldestCachedSurface should not dereference an end() iterator
- Out-of-bounds read in -[RTCVideoEncoderH265/H264 frameWasEncoded:] — AppendData uses total CMBlockBuffer size instead of chunk length
- Make B3 ccmp chain matcher use RAII
- [WebGPU] Unsubmitted command encoder can poison drawIndirect clamp cache leading to GPU OOB vertex fetch
- Cache invalidation bypass via monotonic max-index tracking leads to GPU OOB read
2026-W34 2026-08-22 – 28
- [Wasm] Exclude wasmBoundsCheckingSizeRegister from the callee saves restored
- [WebRTC] Out-of-bounds write in copyVideoFrameBuffer for odd-width I420/I010 frames
- [WebRTC] Out-of-bounds write in copyVideoFrameBuffer for odd-width I420/I010 frames
- missing bounds check in RtpPacket::SetCsrcs for RTCEncodedVideoFrameMetadata.contributingSources
- [ANGLE] MSL translator missing integer UB wrappers allow array bounds clamp elimination
- [ANGLE] drawElements*BaseVertex* does not check baseVertex against the vertex buffer size
2026-W33 2026-08-15 – 21
2026-W32 2026-08-08 – 14
- Out-of-bounds read in OpenType vertical GSUB coverage range fill
2026-W31 2026-08-01 – 07
2026-W30 2026-07-25 – 31
2026-W26 2026-06-27 – 07-03
- [CoreIPC] [GPUP] FEComponentTransfer CoreImage Metal kernel can read past bounds with empty tableValues
- Stack buffer overflow in WebKit libwebrtc VideoCodecInitializer via remote SDP simulcast layers leads to WebContent memory corruption
- [WebGPU] PipelineLayout::makeInvalid leaves m_bindGroupLayouts engaged, causing GPU OOB
- [WebGPU] Per-buffer m_mustTakeSlowIndexValidationPath cleared between command buffers leads to GPU OOB vertex fetch
- [CoreIPC][GPU] Queue::writeTexture() 1D replaceRegion fast-path should return early when copyExtent.height is zero
- [libpas] Fix OoBable code-paths in MAR code
- REGRESSION(305413.516@safari-7624-branch): The height of the FEMorphology filter might be off by 1
- Compromised web content processes can use percent-encoded path separators in PDF suggested filenames to write outside temporary directory
- WebGL: GraphicsContextGLANGLE PACK_* state is modifiable through pixelStorei
- [JSC] TypedArray.from() Out-of-Bounds Read via Resizable ArrayBuffer resize/transfer in mapFn callback.
- YarrJIT negativeOffsetIndexedAddress discards adjusted base register
- [GPUP] WebGPU BindGroup Validation-Cache Key Collision Leads to GPU OOB Write
2026-W24 2026-06-13 – 19
- WebGL: Crash when reading pixels to PBO with an offset
- [GPU Process]: Before decoding FEColorMatrix validate the length of the `values` vector
2026-W23 2026-06-06 – 12
- [JSC] YARR RegularExpression heap overflow - duplicate named capture groups
- Check Float16 buffer sizes before conversion
- WebGL: UNSIGNED_INT drawElements() does not validate large indexes correctly
- TrackPrivateBase::removeClient has an inverted bounds check
- [JSC][Temporal] Validate `month` and `eraYear` in Japanese "ce"/"bce" era fast path
2026-W22 2026-05-30 – 06-05
- Masonry fieldset legend passes isSubgrid() despite being excluded from parent grid
- [JSC] Add a test of WebAssembly IPInt stack check
2026-W21 2026-05-23 – 29
- [JSC] Move FTL stack overflow check to prologue
- [JSC] Move DataView null vector check in IC outside of register save/restore
- [ANGLE] Metal backend: Fix crash on OOB vertex attribute offset in syncDirtyAttrib
- [libpas] pas_enumerator_create should check validity of compact heap bump
- [JSC] Incorrect loop condition in ClonedArguments::copyToArguments with non-zero offset
2026-W20 2026-05-16 – 22
- vp9_scale_references: fail if no free buffer is available (Potential 'overflow' issue committed to upstream libwebrtc)
- [JSC] Use scratch buffer for ObjectDefinePropertyFromFields