← WebKit Silent-Fix Report — 2026-W34
0fd61004f1b1dcb44797e0e0059910b47be12b85 IntSize::area() and IntSize::unclampedArea() invoke undefined behavior via std::abs(INT_MIN)
severity medium
class IntegerOverflow
confidence 0.55
platform/graphics/IntSize
Primitive: IntSize::area/unclampedArea invoke UB via std::abs(INT_MIN) and 32-bit overflow
Triage note: std::abs(m_width) on INT_MIN is undefined behavior and the 32-bit multiply can overflow; the fix widens to int64 before abs/multiply, closing a size-computation UB/overflow used for allocation sizing.
Triage note: std::abs(m_width) on INT_MIN is undefined behavior and the 32-bit multiply can overflow; the fix widens to int64 before abs/multiply, closing a size-computation UB/overflow used for allocation sizing.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…