Firefox · DOM
CVE-2026-12292
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
fordom/media/webaudio/AudioNodeEngine.cpp |
modified | |
ifdom/media/webaudio/AudioNodeEngine.cpp |
modified |
Files Changed
dom/media/webaudio/AudioNodeEngine.cppdom/media/webaudio/AudioNodeEngine.h
Patch
diff --git a/dom/media/webaudio/AudioNodeEngine.cpp b/dom/media/webaudio/AudioNodeEngine.cpp
index eb80304c5be..1ff03bbfca7 100644
--- a/dom/media/webaudio/AudioNodeEngine.cpp
+++ b/dom/media/webaudio/AudioNodeEngine.cpp
@@ -29,7 +29,7 @@ ThreadSharedFloatArrayBufferList::Create(uint32_t aChannelCount, size_t aLength,
new ThreadSharedFloatArrayBufferList(aChannelCount);
for (uint32_t i = 0; i < aChannelCount; ++i) {
- float* channelData = js_pod_malloc<float>(aLength);
+ float* channelData = js_pod_calloc<float>(aLength);
if (!channelData) {
return nullptr;
}
diff --git a/dom/media/webaudio/AudioNodeEngine.h b/dom/media/webaudio/AudioNodeEngine.h
index de7785c086b..4f5af79362c 100644
--- a/dom/media/webaudio/AudioNodeEngine.h
+++ b/dom/media/webaudio/AudioNodeEngine.h
@@ -42,8 +42,8 @@ class ThreadSharedFloatArrayBufferList final : public ThreadSharedObject {
}
/**
* Create with buffers suitable for transfer to
- * JS::NewArrayBufferWithContents(). The buffer contents are uninitialized
- * and so should be set using GetDataForWrite().
+ * JS::NewArrayBufferWithContents(). The buffer contents are
+ * zero-initialised; callers should set them using GetDataForWrite().
*/
static already_AddRefed<ThreadSharedFloatArrayBufferList> Create(
uint32_t aChannelCount, size_t aLength, const mozilla::fallible_t&);
Loading diff…
References
On This Page