squelart
WebCore security specialist
Summary
squelart works almost entirely in WebCore's canvas and pixel-buffer layer — HDR and float16 canvas support, the ArrayPixelBuffer/TypedArrayPixelBuffer refactor, color-space plumbing through ImageData and ShareableBitmapConfiguration, and the convertImagePixels conversion paths. The security and hardening work lands on exactly the surface being extended: buffer-size checks before Float16 conversion, a multiplication overflow in the bytesPerRow() validator, and IOSurface validation on a MachSendRight arriving at WebPageProxy::takeSnapshot(). Systematic-variant candidate: size and stride arithmetic around the newly introduced pixel formats (RGBA16F, BGRX8) and the ImageData constructor paths that only recently became PixelFormat-aware — mismatch handling there is new code guarding old assumptions.
Components
Security Fix History
Hardening Commits
- 2026-08-27 Use a compile-time table of un/accelerated convertImagePixels functions, fix BGRX8
- 2026-08-15 In WebPageProxy::takeSnapshot(), validate IOSurface from MachSendRight 2026-W33
- 2026-06-11 Check Float16 buffer sizes before conversion
- 2026-05-21 StyleOriginatedTimelinesController::documentDidResolveStyle: Use removeIf
- 2026-03-05 Catch multiplication overflow in bytesPerRow() validator
Recent Commits
- 2026-09-18 fullCanvasCompositedDrawImage() should handle full ImagePaintingOptions
- 2026-09-17 createImageBitmap-from-hdr
- 2026-09-16 HDR support for CanvasRenderingContext2DBase::drawImage() of an image
- 2026-09-08 getImageData should return the requested color space even for fingerprinters
- 2026-08-27 Use a compile-time table of un/accelerated convertImagePixels functions, fix BGRX8
- 2026-08-25 Fix pbxproj after 317307@main moved files out of xros
- 2026-08-15 Implement CanvasRenderingContext2DBase::drawImage() for a WebGPU source
- 2026-08-15 In WebPageProxy::takeSnapshot(), validate IOSurface from MachSendRight 2026-W33
- 2026-08-14 Complete HDR CanvasRenderingContext2DBase::drawImage from 2d canvas
- 2026-08-10 Canvas with float16 should use an extended DestinationColorSpace
- 2026-08-07 Accelerated convertImagePixels for PixelFormat::RGBA16F
- 2026-08-04 CanvasRenderingContext2DBase should cache a generic ArrayPixelBuffer
- 2026-08-03 Float16 canvas and ImageData require RGBA16F
- 2026-07-31 Make ImageData work with non-Typed ArrayPixelBuffer
- 2026-07-29 Catch mismatched pixelFormats in ImageData JS constructor