Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionMemory safety bug fixed in Firefox 152
ComponentDOM
Bug ClassLogic Error
Tracker2037323
Fix commit00fa289fdf52 (firefox) +16/-0
CISA KEVNot listed
CreditedMihalis Haatainen
Disclosed2026-06-16

Changed Functions

FunctionChangeNotes
if
dom/canvas/WebGL2ContextBuffers.cpp
modified

Files Changed

  • dom/canvas/WebGL2ContextBuffers.cpp
diff --git a/dom/canvas/WebGL2ContextBuffers.cpp b/dom/canvas/WebGL2ContextBuffers.cpp
index 5012c70ff3e..761a3ee3d0d 100644
--- a/dom/canvas/WebGL2ContextBuffers.cpp
+++ b/dom/canvas/WebGL2ContextBuffers.cpp
@@ -73,6 +73,22 @@ void WebGL2Context::CopyBufferSubData(GLenum readTarget, GLenum writeTarget,
   gl->fCopyBufferSubData(readTarget, writeTarget, readOffset, writeOffset,
                          size);
 
+  // Update the destination index cache if needed.
+  if (writeBuffer->mIndexCache) {
+    MOZ_ASSERT(readBuffer->mIndexCache);
+    if (readBuffer->mIndexCache) {
+      // The read and write ranges have been validated above by fnValidateOffsetSize.
+      // If allocated, the size of mIndexCache is always mByteLength.
+      const auto* src =
+          static_cast<const uint8_t*>(readBuffer->mIndexCache.get()) +
+          readOffset;
+      auto* dst =
+          static_cast<uint8_t*>(writeBuffer->mIndexCache.get()) + writeOffset;
+      memcpy(dst, src, size);
+    }
+    writeBuffer->InvalidateCacheRange(writeOffset, size);
+  }
+
   writeBuffer->ResetLastUpdateFenceId();
 }
 
Loading diff…