[rootvector2]

Description

RectT::IsSame compared the height with ysize_ <= other.ysize_ instead of ==, so a rect that is shorter or taller than the reference still compared equal.

The APNG decoder validates each fcTL frame viewport against the image bounds with raw_viewport.Intersection(image_rect).IsSame(raw_viewport) in third_party/apngdis/dec.cc. Intersection clips the viewport to the image and IsSame is meant to detect that the clip changed the rect. Because the clipped height is always <= the original, a frame whose viewport extended past the image bottom passed the check. finalize_frame then uses that viewport height to bound memcpy(..., frameRaw.rows[y], ...), where frameRaw.rows was sized to the real image height, so rows[y] is read out of bounds and its uninitialized pointer dereferenced.

A frame with viewport {0, 0, width, height + N} on a width x height image triggers it: the check accepts it today and rejects it after the fix. lib/base/rect_test.cc covers both IsSame directly and the intersection-based viewport check.

The same comparison was fixed upstream in libjxl (PR #4870).

Pull Request Checklist

• CLA Signed: Have you signed the Contributor License Agreement (individual or corporate, as appropriate)? Only contributions from signed contributors can be accepted.
• Authors: Have you considered adding your name to the AUTHORS file?
• Code Style: Have you ensured your code adheres to the project's coding style guidelines? You can use ./ci.sh lint for automatic code formatting.

[gemini-code-assist]

Code Review

This pull request fixes a bug in the RectT::IsSame method in lib/base/rect.h where the height comparison was incorrectly using <= instead of ==. It also adds corresponding unit tests in lib/base/rect_test.cc and registers them in lib/jpegli_lists.cmake. There are no review comments, and I have no additional feedback to provide.