Firefox · Media
CVE-2026-100756
Logic Error in Media
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
formedia/ffvpx/libavcodec/vp9.c |
modified | |
formedia/ffvpx/vp9-flush-unref-next-refs.patch |
modified |
Files Changed
media/ffvpx/README_MOZILLAmedia/ffvpx/libavcodec/vp9.cmedia/ffvpx/vp9-flush-unref-next-refs.patch
Patch
diff --git a/media/ffvpx/README_MOZILLA b/media/ffvpx/README_MOZILLA
index 1c78fb2e1a7..0cd085aeb01 100644
--- a/media/ffvpx/README_MOZILLA
+++ b/media/ffvpx/README_MOZILLA
@@ -162,3 +162,6 @@ Finally, apply the patches:
neither, so multichannel Vorbis plays with its channels permuted
(bug 1991957). Drop this patch if it is ever fixed upstream.
- av1_tilesize.patch to clean up av1 tile handling
+- vp9-flush-unref-next-refs.patch to clear VP9 frame-thread references on
+ flush. Cherry-pick of FFmpeg commit a024f8c5413d, which is not in the 9.0
+ release branch; drop this patch once ffvpx is updated past it.
diff --git a/media/ffvpx/libavcodec/vp9.c b/media/ffvpx/libavcodec/vp9.c
index 7957cbeab9a..22655c9e7cf 100644
--- a/media/ffvpx/libavcodec/vp9.c
+++ b/media/ffvpx/libavcodec/vp9.c
@@ -1844,6 +1844,7 @@ static av_cold void vp9_decode_flush(AVCodecContext *avctx)
for (i = 0; i < 8; i++) {
ff_progress_frame_unref(&s->s.refs[i]);
+ ff_progress_frame_unref(&s->next_refs[i]);
vp9_frame_unref(&s->s.ref_frames[i]);
}
diff --git a/media/ffvpx/vp9-flush-unref-next-refs.patch b/media/ffvpx/vp9-flush-unref-next-refs.patch
new file mode 100644
index 00000000000..77f13c0da2f
--- /dev/null
+++ b/media/ffvpx/vp9-flush-unref-next-refs.patch
@@ -0,0 +1,11 @@
+diff --git a/media/ffvpx/libavcodec/vp9.c b/media/ffvpx/libavcodec/vp9.c
+--- a/media/ffvpx/libavcodec/vp9.c
++++ b/media/ffvpx/libavcodec/vp9.c
+@@ -1844,6 +1844,7 @@ static av_cold void vp9_decode_flush(AVCodecContext *avctx)
+
+ for (i = 0; i < 8; i++) {
+ ff_progress_frame_unref(&s->s.refs[i]);
++ ff_progress_frame_unref(&s->next_refs[i]);
+ vp9_frame_unref(&s->s.ref_frames[i]);
+ }
+
Loading diff…
References
On This Page