High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape due to uninitialized memory in the Graphics component
ComponentGraphics
Bug ClassLogic Error
Tracker2068420
Fix commit91ffee74062d (firefox) +32/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-13

Files Changed

  • gfx/cairo/cairo/src/cairo-boxes-intersect.c
  • gfx/cairo/moz.yaml
  • gfx/cairo/patches/0051-Bug-2068420-skip-head-sentinel.patch
diff --git a/gfx/cairo/cairo/src/cairo-boxes-intersect.c b/gfx/cairo/cairo/src/cairo-boxes-intersect.c
index 96ae66334e6..e2925a4e1cf 100644
--- a/gfx/cairo/cairo/src/cairo-boxes-intersect.c
+++ b/gfx/cairo/cairo/src/cairo-boxes-intersect.c
@@ -267,11 +267,13 @@ sweep_line_init (sweep_line_t	 *sweep_line,
     sweep_line->head.x = INT32_MIN;
     sweep_line->head.right = NULL;
     sweep_line->head.dir = 0;
+    sweep_line->head.prev = NULL;
     sweep_line->head.next = &sweep_line->tail;
     sweep_line->tail.x = INT32_MAX;
     sweep_line->tail.right = NULL;
     sweep_line->tail.dir = 0;
     sweep_line->tail.prev = &sweep_line->head;
+    sweep_line->tail.next = NULL;
 
     sweep_line->insert_left = &sweep_line->tail;
     sweep_line->insert_right = &sweep_line->tail;
@@ -475,6 +477,8 @@ sweep_line_insert (sweep_line_t	*sweep, rectangle_t	*rectangle)
     pos = sweep->insert_left;
     if (pos->x > sweep->insert_right->x)
 	pos = sweep->insert_right->prev;
+    if (pos == &sweep->head)
+	pos = pos->next;
     insert_edge (&rectangle->left, pos);
     sweep->insert_left = &rectangle->left;
 
diff --git a/gfx/cairo/moz.yaml b/gfx/cairo/moz.yaml
index d1663f8e5a5..3347765c345 100644
--- a/gfx/cairo/moz.yaml
+++ b/gfx/cairo/moz.yaml
@@ -94,6 +94,7 @@ vendoring:
     - patches/0048-Bug-2054626-type2-decode-integer.patch
     - patches/0049-Bug-2054627-skip-token-check.patch
     - patches/0050-Bug-2068367-bitmap-surface-tmp-buffer.patch
+    - patches/0051-Bug-2068420-skip-head-sentinel.patch
 
 updatebot:
   maintainer-phab: "#gfx-reviewers"
diff --git a/gfx/cairo/patches/0051-Bug-2068420-skip-head-sentinel.patch b/gfx/cairo/patches/0051-Bug-2068420-skip-head-sentinel.patch
new file mode 100644
index 00000000000..14278e202c5
--- /dev/null
+++ b/gfx/cairo/patches/0051-Bug-2068420-skip-head-sentinel.patch
@@ -0,0 +1,27 @@
+diff --git a/src/cairo-boxes-intersect.c b/src/cairo-boxes-intersect.c
+index 96ae66334e6a..e2925a4e1cf2 100644
+--- a/src/cairo-boxes-intersect.c
++++ b/src/cairo-boxes-intersect.c
+@@ -267,11 +267,13 @@ sweep_line_init (sweep_line_t	 *sweep_line,
+     sweep_line->head.x = INT32_MIN;
+     sweep_line->head.right = NULL;
+     sweep_line->head.dir = 0;
++    sweep_line->head.prev = NULL;
+     sweep_line->head.next = &sweep_line->tail;
+     sweep_line->tail.x = INT32_MAX;
+     sweep_line->tail.right = NULL;
+     sweep_line->tail.dir = 0;
+     sweep_line->tail.prev = &sweep_line->head;
++    sweep_line->tail.next = NULL;
+ 
+     sweep_line->insert_left = &sweep_line->tail;
+     sweep_line->insert_right = &sweep_line->tail;
+@@ -475,6 +477,8 @@ sweep_line_insert (sweep_line_t	*sweep, rectangle_t	*rectangle)
+     pos = sweep->insert_left;
+     if (pos->x > sweep->insert_right->x)
+ 	pos = sweep->insert_right->prev;
++    if (pos == &sweep->head)
++	pos = pos->next;
+     insert_edge (&rectangle->left, pos);
+     sweep->insert_left = &rectangle->left;
+ 
Loading diff…