High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionIncorrect boundary conditions in the Audio/Video: Playback component
ComponentMedia
Bug ClassLogic Error
Tracker2047721
Fix commitf56ed02288be (firefox) +15/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-29

Changed Functions

FunctionChangeNotes
for
media/ffvpx/libavcodec/vp9.c
modified
for
media/ffvpx/vp9-flush-unref-next-refs.patch
modified

Files Changed

  • media/ffvpx/README_MOZILLA
  • media/ffvpx/libavcodec/vp9.c
  • media/ffvpx/vp9-flush-unref-next-refs.patch
diff --git a/media/ffvpx/README_MOZILLA b/media/ffvpx/README_MOZILLA
index 1c78fb2e1a7..0cd085aeb01 100644
--- a/media/ffvpx/README_MOZILLA
+++ b/media/ffvpx/README_MOZILLA
@@ -162,3 +162,6 @@ Finally, apply the patches:
   neither, so multichannel Vorbis plays with its channels permuted
   (bug 1991957). Drop this patch if it is ever fixed upstream.
 - av1_tilesize.patch to clean up av1 tile handling
+- vp9-flush-unref-next-refs.patch to clear VP9 frame-thread references on
+  flush. Cherry-pick of FFmpeg commit a024f8c5413d, which is not in the 9.0
+  release branch; drop this patch once ffvpx is updated past it.
diff --git a/media/ffvpx/libavcodec/vp9.c b/media/ffvpx/libavcodec/vp9.c
index 7957cbeab9a..22655c9e7cf 100644
--- a/media/ffvpx/libavcodec/vp9.c
+++ b/media/ffvpx/libavcodec/vp9.c
@@ -1844,6 +1844,7 @@ static av_cold void vp9_decode_flush(AVCodecContext *avctx)
 
     for (i = 0; i < 8; i++) {
         ff_progress_frame_unref(&s->s.refs[i]);
+        ff_progress_frame_unref(&s->next_refs[i]);
         vp9_frame_unref(&s->s.ref_frames[i]);
     }
 
diff --git a/media/ffvpx/vp9-flush-unref-next-refs.patch b/media/ffvpx/vp9-flush-unref-next-refs.patch
new file mode 100644
index 00000000000..77f13c0da2f
--- /dev/null
+++ b/media/ffvpx/vp9-flush-unref-next-refs.patch
@@ -0,0 +1,11 @@
+diff --git a/media/ffvpx/libavcodec/vp9.c b/media/ffvpx/libavcodec/vp9.c
+--- a/media/ffvpx/libavcodec/vp9.c
++++ b/media/ffvpx/libavcodec/vp9.c
+@@ -1844,6 +1844,7 @@ static av_cold void vp9_decode_flush(AVCodecContext *avctx)
+ 
+     for (i = 0; i < 8; i++) {
+         ff_progress_frame_unref(&s->s.refs[i]);
++        ff_progress_frame_unref(&s->next_refs[i]);
+         vp9_frame_unref(&s->s.ref_frames[i]);
+     }
+ 
Loading diff…