Firefox · Graphics
CVE-2026-109731
Logic Error in Graphics
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
PathOpsgfx/2d/PathRecording.h |
modified |
Files Changed
gfx/2d/PathRecording.cppgfx/2d/PathRecording.h
Patch
diff --git a/gfx/2d/PathRecording.cpp b/gfx/2d/PathRecording.cpp
index 87f7ed2894e..2091f172b55 100644
--- a/gfx/2d/PathRecording.cpp
+++ b/gfx/2d/PathRecording.cpp
@@ -147,7 +147,7 @@ bool PathOps::CheckedStreamToSink(PathSink& aPathSink) const {
void PathOps::TransformedCopyTo(const Matrix& aTransform,
PathOps& aDest) const {
- MOZ_ALWAYS_TRUE(
+ MOZ_RELEASE_ASSERT(
aDest.mPathData.reserve(aDest.mPathData.length() + mPathData.length()));
const uint8_t* nextByte = mPathData.begin();
const uint8_t* end = mPathData.end();
diff --git a/gfx/2d/PathRecording.h b/gfx/2d/PathRecording.h
index 22686030ba7..fcf2686dc44 100644
--- a/gfx/2d/PathRecording.h
+++ b/gfx/2d/PathRecording.h
@@ -21,7 +21,7 @@ class PathOps {
explicit PathOps(S& aStream);
PathOps(const PathOps& aOther) {
- MOZ_ALWAYS_TRUE(
+ MOZ_RELEASE_ASSERT(
mPathData.append(aOther.mPathData.begin(), aOther.mPathData.length()));
}
PathOps& operator=(const PathOps&) = delete; // assign using std::move()!
@@ -58,14 +58,14 @@ class PathOps {
template <typename T>
void AppendPathOp(const T& aOpData) {
- MOZ_ALWAYS_TRUE(
+ MOZ_RELEASE_ASSERT(
mPathData.append((const uint8_t*)(&aOpData), sizeof(aOpData)));
}
template <typename T>
void AppendPathOp(const OpType& aOpType, const T& aOpParams) {
- MOZ_ALWAYS_TRUE(mPathData.reserve(mPathData.length() + sizeof(aOpType) +
- sizeof(aOpParams)));
+ MOZ_RELEASE_ASSERT(mPathData.reserve(mPathData.length() + sizeof(aOpType) +
+ sizeof(aOpParams)));
mPathData.infallibleAppend((const uint8_t*)&aOpType, sizeof(aOpType));
mPathData.infallibleAppend((const uint8_t*)&aOpParams, sizeof(aOpParams));
}
Loading diff…
References
On This Page