Firefox · Graphics
CVE-2026-2760
Sandbox Escape in Graphics
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifgfx/ycbcr/yuv_convert.cpp |
modified |
Files Changed
gfx/ycbcr/yuv_convert.cpp
Patch
diff --git a/gfx/ycbcr/yuv_convert.cpp b/gfx/ycbcr/yuv_convert.cpp
index e225bd8ee40..e0befc10b94 100644
--- a/gfx/ycbcr/yuv_convert.cpp
+++ b/gfx/ycbcr/yuv_convert.cpp
@@ -96,6 +96,11 @@ ConvertYCbCrToRGB32(const uint8_t* y_buf,
YUVColorSpace yuv_color_space,
ColorRange color_range,
RGB32Type rgb32_type) {
+ if (pic_x < 0 || pic_y < 0 || y_pitch < 0 || uv_pitch < 0 || rgb_pitch < 0) {
+ NS_WARNING("Negative origin or pitch is unsupported");
+ return NS_ERROR_NOT_IMPLEMENTED;
+ }
+
// Deprecated function's conversion is accurate.
// libyuv converion is a bit inaccurate to get performance. It dynamically
// calculates RGB from YUV to use simd. In it, signed byte is used for
Loading diff…
References
On This Page