High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionIncorrect boundary conditions in the Web Audio component
ComponentDOM
Bug ClassLogic Error
Tracker2014832
Fix commit63376b3965e8 (firefox) +14/-1
CISA KEVNot listed
CreditedEvyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
Disclosed2026-02-24

Changed Functions

FunctionChangeNotes
if
dom/media/webaudio/MediaBufferDecoder.cpp
modified

Files Changed

  • dom/media/webaudio/MediaBufferDecoder.cpp
diff --git a/dom/media/webaudio/MediaBufferDecoder.cpp b/dom/media/webaudio/MediaBufferDecoder.cpp
index 0c8ead37723..2e5de55873c 100644
--- a/dom/media/webaudio/MediaBufferDecoder.cpp
+++ b/dom/media/webaudio/MediaBufferDecoder.cpp
@@ -229,7 +229,12 @@ class AutoResampler final {
     MOZ_ASSERT(mResampler);
     return mResampler;
   }
-  void operator=(SpeexResamplerState* aResampler) { mResampler = aResampler; }
+  void operator=(SpeexResamplerState* aResampler) {
+    if (mResampler) {
+      speex_resampler_destroy(mResampler);
+    }
+    mResampler = aResampler;
+  }
 
  private:
   SpeexResamplerState* mResampler;
@@ -564,6 +569,14 @@ void MediaDecodeTask::FinishDecode() {
       }
       mDecodeJob.mBuffer.mBuffer = std::move(newBuffers);
       channelCount = audioData->mChannels;
+
+      // Don't bother draining the previous resampler for unexpected edge case.
+      if (sampleRate != destSampleRate) {
+        resampler =
+            speex_resampler_init(channelCount, sampleRate, destSampleRate,
+                                 SPEEX_RESAMPLER_QUALITY_DEFAULT, nullptr);
+        speex_resampler_skip_zeros(resampler);
+      }
     }
 
     const AudioDataValue* bufferData =
Loading diff…