Firefox · Graphics
CVE-2026-4684
UAF in Graphics
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifgfx/layers/wr/WebRenderBridgeParent.cpp |
modified | |
forgfx/layers/wr/WebRenderBridgeParent.cpp |
modified |
Files Changed
gfx/layers/wr/WebRenderBridgeParent.cpp
Patch
diff --git a/gfx/layers/wr/WebRenderBridgeParent.cpp b/gfx/layers/wr/WebRenderBridgeParent.cpp
index 0b6260460f1..885a199bd32 100644
--- a/gfx/layers/wr/WebRenderBridgeParent.cpp
+++ b/gfx/layers/wr/WebRenderBridgeParent.cpp
@@ -324,8 +324,19 @@ class MOZ_STACK_CLASS AutoWebRenderBridgeParentAsyncMessageSender final {
mWebRenderBridgeParent->SendPendingAsyncMessages();
if (mActorsToDestroy) {
// Destroy the actors after sending the async messages because the latter
- // may contain references to some actors.
+ // may contain references to some actors. De-duplicate the array to avoid
+ // destroying the same texture parent actor twice.
+ nsTHashSet<PTextureParent*> seenTextureParents;
for (const auto& op : *mActorsToDestroy) {
+ // Peek inside the op (as DestroyActor does) to see if we are about
+ // to destroy a PTextureParent.
+ if (op.type() == OpDestroy::TPTexture) {
+ PTextureParent* textureParent = op.get_PTexture().AsParent();
+ if (!seenTextureParents.EnsureInserted(textureParent)) {
+ // Already seen, so skip this one.
+ continue;
+ }
+ }
mWebRenderBridgeParent->DestroyActor(op);
}
}
Loading diff…
References
On This Page