Firefox · Graphics
CVE-2026-100786
Logic Error in Graphics
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifgfx/layers/composite/TextureHost.cpp |
modified |
Files Changed
gfx/layers/composite/TextureHost.cpp
Patch
diff --git a/gfx/layers/composite/TextureHost.cpp b/gfx/layers/composite/TextureHost.cpp
index 4ddba79f525..3fb7b8bee64 100644
--- a/gfx/layers/composite/TextureHost.cpp
+++ b/gfx/layers/composite/TextureHost.cpp
@@ -180,10 +180,15 @@ already_AddRefed<TextureHost> CreateDummyBufferTextureHost(
aFlags |= TextureFlags::DUMMY_TEXTURE;
UniquePtr<TextureData> textureData(BufferTextureData::Create(
gfx::IntSize(1, 1), gfx::SurfaceFormat::B8G8R8A8, gfx::ColorSpace2::SRGB,
- gfx::TransferFunction::SRGB, gfx::BackendType::SKIA, aBackend, aFlags,
- TextureAllocationFlags::ALLOC_DEFAULT, nullptr));
+ gfx::TransferFunction::SRGB, gfx::BackendType::SKIA, aBackend,
+ TextureFlags::NO_FLAGS, TextureAllocationFlags::ALLOC_DEFAULT, nullptr));
+ if (!textureData) {
+ return nullptr;
+ }
SurfaceDescriptor surfDesc;
- textureData->Serialize(surfDesc);
+ if (!textureData->Serialize(surfDesc)) {
+ return nullptr;
+ }
const SurfaceDescriptorBuffer& bufferDesc =
surfDesc.get_SurfaceDescriptorBuffer();
const MemoryOrShmem& data = bufferDesc.data();
Loading diff…
References
On This Page