OOB
33 commits
Out-of-bounds read or write, buffer overflow, missing bounds check.
2026-W33 2026-08-15 – 21
2026-W32 2026-08-08 – 14
- Out-of-bounds read in OpenType vertical GSUB coverage range fill
2026-W31 2026-08-01 – 07
2026-W30 2026-07-25 – 31
2026-W26 2026-06-27 – 07-03
- [CoreIPC] [GPUP] FEComponentTransfer CoreImage Metal kernel can read past bounds with empty tableValues
- Stack buffer overflow in WebKit libwebrtc VideoCodecInitializer via remote SDP simulcast layers leads to WebContent memory corruption
- [WebGPU] PipelineLayout::makeInvalid leaves m_bindGroupLayouts engaged, causing GPU OOB
- [WebGPU] Per-buffer m_mustTakeSlowIndexValidationPath cleared between command buffers leads to GPU OOB vertex fetch
- [CoreIPC][GPU] Queue::writeTexture() 1D replaceRegion fast-path should return early when copyExtent.height is zero
- [libpas] Fix OoBable code-paths in MAR code
- REGRESSION(305413.516@safari-7624-branch): The height of the FEMorphology filter might be off by 1
- Compromised web content processes can use percent-encoded path separators in PDF suggested filenames to write outside temporary directory
- WebGL: GraphicsContextGLANGLE PACK_* state is modifiable through pixelStorei
- [JSC] TypedArray.from() Out-of-Bounds Read via Resizable ArrayBuffer resize/transfer in mapFn callback.
- YarrJIT negativeOffsetIndexedAddress discards adjusted base register
- [GPUP] WebGPU BindGroup Validation-Cache Key Collision Leads to GPU OOB Write
2026-W24 2026-06-13 – 19
- WebGL: Crash when reading pixels to PBO with an offset
- [GPU Process]: Before decoding FEColorMatrix validate the length of the `values` vector
2026-W23 2026-06-06 – 12
- [JSC] YARR RegularExpression heap overflow - duplicate named capture groups
- Check Float16 buffer sizes before conversion
- WebGL: UNSIGNED_INT drawElements() does not validate large indexes correctly
- TrackPrivateBase::removeClient has an inverted bounds check
- [JSC][Temporal] Validate `month` and `eraYear` in Japanese "ce"/"bce" era fast path
2026-W22 2026-05-30 – 06-05
- Masonry fieldset legend passes isSubgrid() despite being excluded from parent grid
- [JSC] Add a test of WebAssembly IPInt stack check
2026-W21 2026-05-23 – 29
- [JSC] Move FTL stack overflow check to prologue
- [JSC] Move DataView null vector check in IC outside of register save/restore
- [ANGLE] Metal backend: Fix crash on OOB vertex attribute offset in syncDirtyAttrib
- [libpas] pas_enumerator_create should check validity of compact heap bump
- [JSC] Incorrect loop condition in ClonedArguments::copyToArguments with non-zero offset
2026-W20 2026-05-16 – 22
- vp9_scale_references: fail if no free buffer is available (Potential 'overflow' issue committed to upstream libwebrtc)
- [JSC] Use scratch buffer for ObjectDefinePropertyFromFields