Firefox · Graphics
CVE-2026-109712
Logic Error in Graphics
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
gfx/cairo/cairo/src/cairo-boxes-intersect.cgfx/cairo/moz.yamlgfx/cairo/patches/0051-Bug-2068420-skip-head-sentinel.patch
Patch
diff --git a/gfx/cairo/cairo/src/cairo-boxes-intersect.c b/gfx/cairo/cairo/src/cairo-boxes-intersect.c
index 96ae66334e6..e2925a4e1cf 100644
--- a/gfx/cairo/cairo/src/cairo-boxes-intersect.c
+++ b/gfx/cairo/cairo/src/cairo-boxes-intersect.c
@@ -267,11 +267,13 @@ sweep_line_init (sweep_line_t *sweep_line,
sweep_line->head.x = INT32_MIN;
sweep_line->head.right = NULL;
sweep_line->head.dir = 0;
+ sweep_line->head.prev = NULL;
sweep_line->head.next = &sweep_line->tail;
sweep_line->tail.x = INT32_MAX;
sweep_line->tail.right = NULL;
sweep_line->tail.dir = 0;
sweep_line->tail.prev = &sweep_line->head;
+ sweep_line->tail.next = NULL;
sweep_line->insert_left = &sweep_line->tail;
sweep_line->insert_right = &sweep_line->tail;
@@ -475,6 +477,8 @@ sweep_line_insert (sweep_line_t *sweep, rectangle_t *rectangle)
pos = sweep->insert_left;
if (pos->x > sweep->insert_right->x)
pos = sweep->insert_right->prev;
+ if (pos == &sweep->head)
+ pos = pos->next;
insert_edge (&rectangle->left, pos);
sweep->insert_left = &rectangle->left;
diff --git a/gfx/cairo/moz.yaml b/gfx/cairo/moz.yaml
index d1663f8e5a5..3347765c345 100644
--- a/gfx/cairo/moz.yaml
+++ b/gfx/cairo/moz.yaml
@@ -94,6 +94,7 @@ vendoring:
- patches/0048-Bug-2054626-type2-decode-integer.patch
- patches/0049-Bug-2054627-skip-token-check.patch
- patches/0050-Bug-2068367-bitmap-surface-tmp-buffer.patch
+ - patches/0051-Bug-2068420-skip-head-sentinel.patch
updatebot:
maintainer-phab: "#gfx-reviewers"
diff --git a/gfx/cairo/patches/0051-Bug-2068420-skip-head-sentinel.patch b/gfx/cairo/patches/0051-Bug-2068420-skip-head-sentinel.patch
new file mode 100644
index 00000000000..14278e202c5
--- /dev/null
+++ b/gfx/cairo/patches/0051-Bug-2068420-skip-head-sentinel.patch
@@ -0,0 +1,27 @@
+diff --git a/src/cairo-boxes-intersect.c b/src/cairo-boxes-intersect.c
+index 96ae66334e6a..e2925a4e1cf2 100644
+--- a/src/cairo-boxes-intersect.c
++++ b/src/cairo-boxes-intersect.c
+@@ -267,11 +267,13 @@ sweep_line_init (sweep_line_t *sweep_line,
+ sweep_line->head.x = INT32_MIN;
+ sweep_line->head.right = NULL;
+ sweep_line->head.dir = 0;
++ sweep_line->head.prev = NULL;
+ sweep_line->head.next = &sweep_line->tail;
+ sweep_line->tail.x = INT32_MAX;
+ sweep_line->tail.right = NULL;
+ sweep_line->tail.dir = 0;
+ sweep_line->tail.prev = &sweep_line->head;
++ sweep_line->tail.next = NULL;
+
+ sweep_line->insert_left = &sweep_line->tail;
+ sweep_line->insert_right = &sweep_line->tail;
+@@ -475,6 +477,8 @@ sweep_line_insert (sweep_line_t *sweep, rectangle_t *rectangle)
+ pos = sweep->insert_left;
+ if (pos->x > sweep->insert_right->x)
+ pos = sweep->insert_right->prev;
++ if (pos == &sweep->head)
++ pos = pos->next;
+ insert_edge (&rectangle->left, pos);
+ sweep->insert_left = &rectangle->left;
+
Loading diff…
References
On This Page