Firefox · Graphics
CVE-2026-117902
Logic Error in Graphics
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifgfx/thebes/gfxPlatformFontList.h |
modified | |
gfxUserFontSetgfx/thebes/gfxUserFontSet.h |
modified |
Files Changed
gfx/thebes/gfxPlatformFontList.hgfx/thebes/gfxUserFontSet.h
Patch
diff --git a/gfx/thebes/gfxPlatformFontList.h b/gfx/thebes/gfxPlatformFontList.h
index 66290cd7044..4719c99e05d 100644
--- a/gfx/thebes/gfxPlatformFontList.h
+++ b/gfx/thebes/gfxPlatformFontList.h
@@ -554,11 +554,16 @@ class gfxPlatformFontList : public gfxFontInfoLoader {
// Keep track of userfont sets to notify when global fontlist changes occur.
void AddUserFontSet(gfxUserFontSet* aUserFontSet) {
AutoLock lock(mLock);
- mUserFontSetList.Insert(aUserFontSet);
+ if (!aUserFontSet->mDestroying) {
+ mUserFontSetList.Insert(aUserFontSet);
+ }
}
+ // Called from the font-set destructor, to notify that the set is being
+ // destroyed and should no longer be tracked here.
void RemoveUserFontSet(gfxUserFontSet* aUserFontSet) {
AutoLock lock(mLock);
+ aUserFontSet->mDestroying = true;
mUserFontSetList.Remove(aUserFontSet);
}
diff --git a/gfx/thebes/gfxUserFontSet.h b/gfx/thebes/gfxUserFontSet.h
index 5a7e0b5348b..d5f329bcff9 100644
--- a/gfx/thebes/gfxUserFontSet.h
+++ b/gfx/thebes/gfxUserFontSet.h
@@ -264,6 +264,7 @@ struct gfxUserFontAttributes {
class gfxUserFontSet {
friend class gfxUserFontEntry;
friend class gfxOTSMessageContext;
+ friend class gfxPlatformFontList;
public:
using FontWidth = mozilla::FontWidth;
@@ -562,6 +563,11 @@ class gfxUserFontSet {
// true when rules using local names need to be redone
bool mRebuildLocalRules;
+ // Set when this font-set is being destroyed, to prevent re-adding it to the
+ // gfxPlatformFontList's list of active font sets.
+ // Guarded by the platform font-list lock.
+ bool mDestroying = false;
+
// performance stats
uint32_t mDownloadCount;
uint64_t mDownloadSize;
Loading diff…
References
On This Page