Firefox · DOM
CVE-2026-4710
Logic Error in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/media/ipc/RemoteImageHolder.cpp
Patch
diff --git a/dom/media/ipc/RemoteImageHolder.cpp b/dom/media/ipc/RemoteImageHolder.cpp
index e0e303eb174..9e42bbf4a08 100644
--- a/dom/media/ipc/RemoteImageHolder.cpp
+++ b/dom/media/ipc/RemoteImageHolder.cpp
@@ -87,6 +87,12 @@ already_AddRefed<Image> RemoteImageHolder::DeserializeImage(
return nullptr;
}
+ if (!IntRect(IntPoint(), descriptor.ySize())
+ .Contains(descriptor.display())) {
+ MOZ_ASSERT_UNREACHABLE("YCbCr display rect exceeds Y plane dimensions!");
+ return nullptr;
+ }
+
PlanarYCbCrData pData;
pData.mYStride = descriptor.yStride();
pData.mCbCrStride = descriptor.cbCrStride();
Loading diff…
References
On This Page