Firefox · Graphics
CVE-2025-10528
Sandbox Escape in Graphics
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
gfx/layers/ipc/CanvasTranslator.cpp
Patch
diff --git a/gfx/layers/ipc/CanvasTranslator.cpp b/gfx/layers/ipc/CanvasTranslator.cpp
index a32b4106077..826f89e52cb 100644
--- a/gfx/layers/ipc/CanvasTranslator.cpp
+++ b/gfx/layers/ipc/CanvasTranslator.cpp
@@ -188,6 +188,10 @@ mozilla::ipc::IPCResult CanvasTranslator::RecvInitTranslator(
}
// Use the first buffer as our current buffer.
+ if (aBufferHandles.IsEmpty()) {
+ Deactivate();
+ return IPC_FAIL(this, "No canvas buffer shared memory supplied.");
+ }
mDefaultBufferSize = aBufferHandles[0].Size();
auto handleIter = aBufferHandles.begin();
mCurrentShmem.shmem = std::move(*handleIter).Map();
@@ -443,11 +447,19 @@ void CanvasTranslator::RemoveExportSurface(gfx::ReferencePtr aRefPtr) {
}
void CanvasTranslator::RecycleBuffer() {
+ if (!mCurrentShmem.IsValid()) {
+ return;
+ }
+
mCanvasShmems.emplace(std::move(mCurrentShmem));
NextBuffer();
}
void CanvasTranslator::NextBuffer() {
+ if (mCanvasShmems.empty()) {
+ return;
+ }
+
// Check and signal the writer when we finish with a buffer, because it
// might have hit the buffer count limit and be waiting to use our old one.
CheckAndSignalWriter();
Loading diff…
References
On This Page