High firefox Memory Corruption 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionMemory safety bugs present in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentGraphics
Bug ClassMemory Corruption
Tracker1970422
Fix commit128b05405784 (firefox) +18/-19
CISA KEVNot listed
Creditedthe Mozilla Fuzzing Team
Disclosed2025-07-22

Changed Functions

FunctionChangeNotes
gfxFontEntry
gfx/thebes/gfxFontEntry.cpp
modified
if
gfx/thebes/gfxFontEntry.cpp
modified

Files Changed

  • gfx/thebes/gfxFontEntry.cpp
  • gfx/thebes/gfxFontEntry.h
diff --git a/gfx/thebes/gfxFontEntry.cpp b/gfx/thebes/gfxFontEntry.cpp
index da3cc7b1e36..dc198bc023f 100644
--- a/gfx/thebes/gfxFontEntry.cpp
+++ b/gfx/thebes/gfxFontEntry.cpp
@@ -412,14 +412,15 @@ bool gfxFontEntry::TryGetColorGlyphs() {
 class gfxFontEntry::FontTableBlobData {
  public:
   explicit FontTableBlobData(nsTArray<uint8_t>&& aBuffer)
-      : mTableData(std::move(aBuffer)), mHashtable(nullptr), mHashKey(0) {
+      : mTableData(std::move(aBuffer)), mFontEntry(nullptr), mHashKey(0) {
     MOZ_COUNT_CTOR(FontTableBlobData);
   }
 
   ~FontTableBlobData() {
     MOZ_COUNT_DTOR(FontTableBlobData);
-    if (mHashtable && mHashKey) {
-      mHashtable->RemoveEntry(mHashKey);
+    if (mFontEntry && mHashKey) {
+      AutoWriteLock lock(mFontEntry->mLock);
+      mFontEntry->mFontTableCache->RemoveEntry(mHashKey);
     }
   }
 
@@ -431,16 +432,15 @@ class gfxFontEntry::FontTableBlobData {
 
   // Tell this FontTableBlobData to remove the HashEntry when this is
   // destroyed.
-  void ManageHashEntry(nsTHashtable<FontTableHashEntry>* aHashtable,
-                       uint32_t aHashKey) {
-    mHashtable = aHashtable;
+  void ManageHashEntry(gfxFontEntry* aFontEntry, uint32_t aHashKey) {
+    mFontEntry = aFontEntry;
     mHashKey = aHashKey;
   }
 
   // Disconnect from the HashEntry (because the blob has already been
   // removed from the hashtable).
   void ForgetHashEntry() {
-    mHashtable = nullptr;
+    mFontEntry = nullptr;
     mHashKey = 0;
   }
 
@@ -455,9 +455,10 @@ class gfxFontEntry::FontTableBlobData {
   // The font table data block
   nsTArray<uint8_t> mTableData;
 
-  // The blob destroy function needs to know the owning hashtable
-  // and the hashtable key, so that it can remove the entry.
-  nsTHashtable<FontTableHashEntry>* mHashtable;
+  // The blob destroy function needs to know the owning font entry
+  // so that it can take the font-entry's lock while modifying the
+  // hashtable; and the hashtable key, so that it can remove the entry.
+  gfxFontEntry* mFontEntry;
   uint32_t mHashKey;
 
   // not implemented
@@ -465,7 +466,7 @@ class gfxFontEntry::FontTableBlobData {
 };
 
 hb_blob_t* gfxFontEntry::FontTableHashEntry::ShareTableAndGetBlob(
-    nsTArray<uint8_t>&& aTable, nsTHashtable<FontTableHashEntry>* aHashtable) {
+    nsTArray<uint8_t>&& aTable, gfxFontEntry* aFontEntry) {
   Clear();
   // adopts elements of aTable
   mSharedBlobData = new FontTableBlobData(std::move(aTable));
@@ -483,7 +484,7 @@ hb_blob_t* gfxFontEntry::FontTableHashEntry::ShareTableAndGetBlob(
 
   // Tell the FontTableBlobData to remove this hash entry when destroyed.
   // The hashtable does not keep a strong reference.
-  mSharedBlobData->ManageHashEntry(aHashtable, GetKey());
+  mSharedBlobData->ManageHashEntry(aFontEntry, GetKey());
   return mBlob;
 }
 
@@ -546,8 +547,7 @@ hb_blob_t* gfxFontEntry::ShareFontTableAndGetBlob(uint32_t aTag,
     return nullptr;
   }
 
-  return entry->ShareTableAndGetBlob(std::move(*aBuffer),
-                                     mFontTableCache.get());
+  return entry->ShareTableAndGetBlob(std::move(*aBuffer), this);
 }
 
 already_AddRefed<gfxCharacterMap> gfxFontEntry::GetCMAPFromFontInfo(
diff --git a/gfx/thebes/gfxFontEntry.h b/gfx/thebes/gfxFontEntry.h
index cf768f0e2d7..d6383ad97ee 100644
--- a/gfx/thebes/gfxFontEntry.h
+++ b/gfx/thebes/gfxFontEntry.h
@@ -876,11 +876,10 @@ class gfxFontEntry {
 
     // Transfer (not copy) elements of aTable to a new hb_blob_t and
     // return ownership to the caller.  A weak reference to the blob is
-    // recorded in the hashtable entry so that others may use the same
-    // table.
-    hb_blob_t* ShareTableAndGetBlob(
-        nsTArray<uint8_t>&& aTable,
-        nsTHashtable<FontTableHashEntry>* aHashtable);
+    // recorded in the font entry's table cache so that others may use
+    // the same table.
+    hb_blob_t* ShareTableAndGetBlob(nsTArray<uint8_t>&& aTable,
+                                    gfxFontEntry* aFontEntry);
 
     // Return a strong reference to the blob.
     // Callers must hb_blob_destroy the returned blob.
Loading diff…