Firefox · Graphics
CVE-2025-8034
Memory Corruption in Graphics
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
gfxFontEntrygfx/thebes/gfxFontEntry.cpp |
modified | |
ifgfx/thebes/gfxFontEntry.cpp |
modified |
Files Changed
gfx/thebes/gfxFontEntry.cppgfx/thebes/gfxFontEntry.h
Patch
diff --git a/gfx/thebes/gfxFontEntry.cpp b/gfx/thebes/gfxFontEntry.cpp
index da3cc7b1e36..dc198bc023f 100644
--- a/gfx/thebes/gfxFontEntry.cpp
+++ b/gfx/thebes/gfxFontEntry.cpp
@@ -412,14 +412,15 @@ bool gfxFontEntry::TryGetColorGlyphs() {
class gfxFontEntry::FontTableBlobData {
public:
explicit FontTableBlobData(nsTArray<uint8_t>&& aBuffer)
- : mTableData(std::move(aBuffer)), mHashtable(nullptr), mHashKey(0) {
+ : mTableData(std::move(aBuffer)), mFontEntry(nullptr), mHashKey(0) {
MOZ_COUNT_CTOR(FontTableBlobData);
}
~FontTableBlobData() {
MOZ_COUNT_DTOR(FontTableBlobData);
- if (mHashtable && mHashKey) {
- mHashtable->RemoveEntry(mHashKey);
+ if (mFontEntry && mHashKey) {
+ AutoWriteLock lock(mFontEntry->mLock);
+ mFontEntry->mFontTableCache->RemoveEntry(mHashKey);
}
}
@@ -431,16 +432,15 @@ class gfxFontEntry::FontTableBlobData {
// Tell this FontTableBlobData to remove the HashEntry when this is
// destroyed.
- void ManageHashEntry(nsTHashtable<FontTableHashEntry>* aHashtable,
- uint32_t aHashKey) {
- mHashtable = aHashtable;
+ void ManageHashEntry(gfxFontEntry* aFontEntry, uint32_t aHashKey) {
+ mFontEntry = aFontEntry;
mHashKey = aHashKey;
}
// Disconnect from the HashEntry (because the blob has already been
// removed from the hashtable).
void ForgetHashEntry() {
- mHashtable = nullptr;
+ mFontEntry = nullptr;
mHashKey = 0;
}
@@ -455,9 +455,10 @@ class gfxFontEntry::FontTableBlobData {
// The font table data block
nsTArray<uint8_t> mTableData;
- // The blob destroy function needs to know the owning hashtable
- // and the hashtable key, so that it can remove the entry.
- nsTHashtable<FontTableHashEntry>* mHashtable;
+ // The blob destroy function needs to know the owning font entry
+ // so that it can take the font-entry's lock while modifying the
+ // hashtable; and the hashtable key, so that it can remove the entry.
+ gfxFontEntry* mFontEntry;
uint32_t mHashKey;
// not implemented
@@ -465,7 +466,7 @@ class gfxFontEntry::FontTableBlobData {
};
hb_blob_t* gfxFontEntry::FontTableHashEntry::ShareTableAndGetBlob(
- nsTArray<uint8_t>&& aTable, nsTHashtable<FontTableHashEntry>* aHashtable) {
+ nsTArray<uint8_t>&& aTable, gfxFontEntry* aFontEntry) {
Clear();
// adopts elements of aTable
mSharedBlobData = new FontTableBlobData(std::move(aTable));
@@ -483,7 +484,7 @@ hb_blob_t* gfxFontEntry::FontTableHashEntry::ShareTableAndGetBlob(
// Tell the FontTableBlobData to remove this hash entry when destroyed.
// The hashtable does not keep a strong reference.
- mSharedBlobData->ManageHashEntry(aHashtable, GetKey());
+ mSharedBlobData->ManageHashEntry(aFontEntry, GetKey());
return mBlob;
}
@@ -546,8 +547,7 @@ hb_blob_t* gfxFontEntry::ShareFontTableAndGetBlob(uint32_t aTag,
return nullptr;
}
- return entry->ShareTableAndGetBlob(std::move(*aBuffer),
- mFontTableCache.get());
+ return entry->ShareTableAndGetBlob(std::move(*aBuffer), this);
}
already_AddRefed<gfxCharacterMap> gfxFontEntry::GetCMAPFromFontInfo(
diff --git a/gfx/thebes/gfxFontEntry.h b/gfx/thebes/gfxFontEntry.h
index cf768f0e2d7..d6383ad97ee 100644
--- a/gfx/thebes/gfxFontEntry.h
+++ b/gfx/thebes/gfxFontEntry.h
@@ -876,11 +876,10 @@ class gfxFontEntry {
// Transfer (not copy) elements of aTable to a new hb_blob_t and
// return ownership to the caller. A weak reference to the blob is
- // recorded in the hashtable entry so that others may use the same
- // table.
- hb_blob_t* ShareTableAndGetBlob(
- nsTArray<uint8_t>&& aTable,
- nsTHashtable<FontTableHashEntry>* aHashtable);
+ // recorded in the font entry's table cache so that others may use
+ // the same table.
+ hb_blob_t* ShareTableAndGetBlob(nsTArray<uint8_t>&& aTable,
+ gfxFontEntry* aFontEntry);
// Return a strong reference to the blob.
// Callers must hb_blob_destroy the returned blob.
Loading diff…
References
On This Page