Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionIncorrect boundary conditions in the Graphics: Canvas2D component
ComponentGraphics
Bug ClassLogic Error
Tracker2015091
Fix commit03d76445bc5f (firefox) +8/-2
CISA KEVNot listed
CreditedJun Yang
Disclosed2026-03-24

Changed Functions

FunctionChangeNotes
if
gfx/2d/FilterNodeSoftware.cpp
modified
switch
gfx/2d/FilterNodeSoftware.cpp
modified

Files Changed

  • gfx/2d/FilterNodeSoftware.cpp
  • gfx/2d/Filters.h
diff --git a/gfx/2d/FilterNodeSoftware.cpp b/gfx/2d/FilterNodeSoftware.cpp
index ec6c3672617..f16dc05f6e2 100644
--- a/gfx/2d/FilterNodeSoftware.cpp
+++ b/gfx/2d/FilterNodeSoftware.cpp
@@ -2591,6 +2591,11 @@ void FilterNodeDisplacementMapSoftware::SetAttribute(uint32_t aIndex,
 
 void FilterNodeDisplacementMapSoftware::SetAttribute(uint32_t aIndex,
                                                      uint32_t aValue) {
+  // Refuse channel values that exceed channel maximum.
+  if (aValue > ColorChannel::COLOR_CHANNEL_MAX) {
+    return;
+  }
+
   switch (aIndex) {
     case ATT_DISPLACEMENT_MAP_X_CHANNEL:
       mChannelX = static_cast<ColorChannel>(aValue);
@@ -2637,7 +2642,7 @@ already_AddRefed<DataSourceSurface> FilterNodeDisplacementMapSoftware::Render(
   uint8_t* targetData = targetMap.GetData();
   int32_t targetStride = targetMap.GetStride();
 
-  static const ptrdiff_t channelMap[4] = {
+  static const ptrdiff_t channelMap[COLOR_CHANNEL_MAX + 1] = {
       B8G8R8A8_COMPONENT_BYTEOFFSET_R, B8G8R8A8_COMPONENT_BYTEOFFSET_G,
       B8G8R8A8_COMPONENT_BYTEOFFSET_B, B8G8R8A8_COMPONENT_BYTEOFFSET_A};
   uint16_t xChannel = channelMap[mChannelX];
diff --git a/gfx/2d/Filters.h b/gfx/2d/Filters.h
index e9d31ce52e2..0a7b4908a05 100644
--- a/gfx/2d/Filters.h
+++ b/gfx/2d/Filters.h
@@ -192,7 +192,8 @@ enum ColorChannel {
   COLOR_CHANNEL_R = 0,
   COLOR_CHANNEL_G,
   COLOR_CHANNEL_B,
-  COLOR_CHANNEL_A
+  COLOR_CHANNEL_A,
+  COLOR_CHANNEL_MAX = COLOR_CHANNEL_A
 };
 
 enum DisplacementMapInputs {
Loading diff…