High firefox Memory Corruption 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionMemory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentDOM
Bug ClassMemory Corruption
Tracker2015196
Fix commitf044ee264c09 (firefox) +2/-8
CISA KEVNot listed
CreditedAndrew McCreight, Christian Holler
Disclosed2026-02-24

Files Changed

  • dom/canvas/TexUnpackBlob.cpp
diff --git a/dom/canvas/TexUnpackBlob.cpp b/dom/canvas/TexUnpackBlob.cpp
index ff8b8f751e8..104e4155bb3 100644
--- a/dom/canvas/TexUnpackBlob.cpp
+++ b/dom/canvas/TexUnpackBlob.cpp
@@ -1172,12 +1172,6 @@ bool TexUnpackSurface::TexOrSubImage(bool isSubImage, bool needsRespec,
 
   ////
 
-  const IntSize surfSize = surf->GetSize();
-  if (uint32_t(surfSize.width) < size.x || uint32_t(surfSize.height) < size.y) {
-    gfxCriticalError() << "Source surface size too small for upload.";
-    return false;
-  }
-
   WebGLTexelFormat srcFormat;
   uint8_t srcBPP;
   if (!GetFormatForSurf(surf, &srcFormat, &srcBPP)) {
@@ -1202,7 +1196,7 @@ bool TexUnpackSurface::TexOrSubImage(bool isSubImage, bool needsRespec,
 
   const auto dstFormat = FormatForPackingInfo(dstPI);
   const size_t dstBpp = BytesPerPixel(dstPI);
-  const size_t dstUsedBytesPerRow = dstBpp * surfSize.width;
+  const size_t dstUsedBytesPerRow = dstBpp * surf->GetSize().width;
   size_t dstStride = dstFormat == srcFormat ? srcStride  // Try To match
                                             : dstUsedBytesPerRow;
 
@@ -1233,7 +1227,7 @@ bool TexUnpackSurface::TexOrSubImage(bool isSubImage, bool needsRespec,
   const uint8_t* dstBegin = srcBegin;
   UniqueBuffer tempBuffer;
   // clang-format off
-  if (!ConvertIfNeeded(webgl, surfSize.width, surfSize.height,
+  if (!ConvertIfNeeded(webgl, surf->GetSize().width, surf->GetSize().height,
                        srcFormat, srcBegin, AutoAssertCast(srcStride),
                        dstFormat, AutoAssertCast(dstUnpacking.metrics.bytesPerRowStride), &dstBegin,
                        &tempBuffer)) {
Loading diff…