← All reports

Revert of the `copyVideoFrameBuffer` odd-width OOB fix

Component: WebCore WebRTC | 7072dd3

copyVideoFrameBuffer copies planar YUV frame buffers (I420/I010) in WebKit's WebRTC video pipeline. These formats use 4:2:0 chroma subsampling, so chroma planes are computed at half the luma width and height; for odd-width frames that requires careful rounding when computing plane strides and sizes, and getting it wrong writes past the end of the destination buffer.

This commit reverts two related changes: the original fix for that out-of-bounds write, and the follow-up commit that attempted to repair an ASan build breakage the fix introduced. Neither was fixed forward.

The odd-width I420/I010 out-of-bounds write is reintroduced on main and is live pending a corrected fix. Two entries in this issue's appendix — dfe0d84 and c18f11b — describe that bug as fixed; as of this revert it is not. The first attempt at a fix also failed to build cleanly under ASan, which is worth noting on its own: a memory-safety fix that breaks the sanitizer build is a fix that the sanitizer cannot vet.