Firefox · DOM
CVE-2024-10463
Logic Error in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/media/VideoFrameContainer.cpp
Patch
diff --git a/dom/media/VideoFrameContainer.cpp b/dom/media/VideoFrameContainer.cpp
index 22ecb995094..f7471cdcca2 100644
--- a/dom/media/VideoFrameContainer.cpp
+++ b/dom/media/VideoFrameContainer.cpp
@@ -152,18 +152,13 @@ void VideoFrameContainer::SetCurrentFramesLocked(
mImageContainer->GetCurrentImages(&oldImages);
PrincipalHandle principalHandle = PRINCIPAL_HANDLE_NONE;
- ImageContainer::FrameID lastFrameIDForOldPrincipalHandle =
- mFrameIDForPendingPrincipalHandle - 1;
if (mPendingPrincipalHandle != PRINCIPAL_HANDLE_NONE &&
- ((!oldImages.IsEmpty() &&
- oldImages.LastElement().mFrameID >= lastFrameIDForOldPrincipalHandle) ||
- (!aImages.IsEmpty() &&
- aImages[0].mFrameID > lastFrameIDForOldPrincipalHandle))) {
- // We are releasing the last FrameID prior to
- // `lastFrameIDForOldPrincipalHandle` OR there are no FrameIDs prior to
- // `lastFrameIDForOldPrincipalHandle` in the new set of images. This means
- // that the old principal handle has been flushed out and we can notify our
- // video element about this change.
+ (aImages.IsEmpty() ||
+ aImages[0].mFrameID >= mFrameIDForPendingPrincipalHandle)) {
+ // There are no FrameIDs prior to `mFrameIDForPendingPrincipalHandle`
+ // in the new set of images.
+ // This means that the old principal handle has been flushed out and we
+ // can notify our video element about this change.
principalHandle = mPendingPrincipalHandle;
mLastPrincipalHandle = mPendingPrincipalHandle;
mPendingPrincipalHandle = PRINCIPAL_HANDLE_NONE;
Loading diff…
References
On This Page