Medium firefox Integer Overflow 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionInteger overflow in the Graphics: ImageLib component
ComponentImageLib
Bug ClassInteger Overflow
Tracker2052703
Fix commit280012e9acbc (firefox) +1/-1
CISA KEVNot listed
CreditedKai Martin
Disclosed2026-07-21

Files Changed

  • image/decoders/nsJXLDecoder.cpp
diff --git a/image/decoders/nsJXLDecoder.cpp b/image/decoders/nsJXLDecoder.cpp
index 3cfaf0fd1bb..ed687b6e782 100644
--- a/image/decoders/nsJXLDecoder.cpp
+++ b/image/decoders/nsJXLDecoder.cpp
@@ -418,7 +418,7 @@ nsresult nsJXLDecoder::AllocateFrameBuffers() {
   }
 
   if (mPixelFormat.value() == PixelFormat::Cmyk8 &&
-      !mKBuffer.resize(size.width * size.height)) {
+      !mKBuffer.resize(size_t(size.width) * size.height)) {
     return NS_ERROR_FAILURE;
   }
 
Loading diff…