Medium firefox UAF 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionUse-after-free in the Graphics: ImageLib component
ComponentImageLib
Bug ClassUAF
Tracker2015179
Fix commit7c12570b0e11 (firefox) +13/-2
CISA KEVNot listed
CreditedEvyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
Disclosed2026-02-24

Changed Functions

FunctionChangeNotes
if
image/SourceBuffer.cpp
modified
if
image/SourceBuffer.h
modified

Files Changed

  • image/SourceBuffer.cpp
  • image/SourceBuffer.h
diff --git a/image/SourceBuffer.cpp b/image/SourceBuffer.cpp
index eaf5ba6beb9..5efe921eff4 100644
--- a/image/SourceBuffer.cpp
+++ b/image/SourceBuffer.cpp
@@ -206,7 +206,11 @@ nsresult SourceBuffer::Compact() {
   if (capacity == MAX_CHUNK_CAPACITY) {
     size_t lastLength = mChunks.LastElement().Length();
     if (lastLength != capacity) {
-      mChunks.LastElement().SetCapacity(lastLength);
+      if (lastLength == 0) {
+        mChunks.RemoveLastElement();
+      } else {
+        mChunks.LastElement().SetCapacity(lastLength);
+      }
     }
     return NS_OK;
   }
@@ -446,6 +450,9 @@ nsresult SourceBuffer::AdoptData(char* aData, size_t aLength,
                                  void (*aFree)(void*)) {
   MOZ_ASSERT(aData, "Should have a buffer");
   MOZ_ASSERT(aLength > 0, "Writing a zero-sized chunk");
+  if (!aData || aLength == 0) {
+    return NS_ERROR_INVALID_ARG;
+  }
   MutexAutoLock lock(mMutex);
   return AppendChunk(Some(Chunk(aData, aLength, aRealloc, aFree)));
 }
diff --git a/image/SourceBuffer.h b/image/SourceBuffer.h
index 77311783d99..cec5145e9f9 100644
--- a/image/SourceBuffer.h
+++ b/image/SourceBuffer.h
@@ -406,7 +406,7 @@ class SourceBuffer final {
     }
 
     Chunk& operator=(Chunk&& aOther) {
-      free(mData);
+      mFree(mData);
       mCapacity = aOther.mCapacity;
       mLength = aOther.mLength;
       mData = aOther.mData;
@@ -431,6 +431,10 @@ class SourceBuffer final {
 
     bool SetCapacity(size_t aCapacity) {
       MOZ_ASSERT(mData, "Allocation failed but nobody checked for it");
+      MOZ_ASSERT(aCapacity > 0, "zero sized resize");
+      if (aCapacity == 0) {
+        return false;
+      }
       char* data = static_cast<char*>(mRealloc(mData, aCapacity));
       if (!data) {
         return false;
Loading diff…