Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionIncorrect boundary conditions in the Audio/Video component
ComponentDOM
Bug ClassLogic Error
Tracker2016370
Fix commitcf45e8f3d886 (firefox) +6/-0
CISA KEVNot listed
CreditedSajeeb Lohani
Disclosed2026-03-24

Files Changed

  • dom/media/ipc/RemoteImageHolder.cpp
diff --git a/dom/media/ipc/RemoteImageHolder.cpp b/dom/media/ipc/RemoteImageHolder.cpp
index e0e303eb174..9e42bbf4a08 100644
--- a/dom/media/ipc/RemoteImageHolder.cpp
+++ b/dom/media/ipc/RemoteImageHolder.cpp
@@ -87,6 +87,12 @@ already_AddRefed<Image> RemoteImageHolder::DeserializeImage(
       return nullptr;
     }
 
+    if (!IntRect(IntPoint(), descriptor.ySize())
+             .Contains(descriptor.display())) {
+      MOZ_ASSERT_UNREACHABLE("YCbCr display rect exceeds Y plane dimensions!");
+      return nullptr;
+    }
+
     PlanarYCbCrData pData;
     pData.mYStride = descriptor.yStride();
     pData.mCbCrStride = descriptor.cbCrStride();
Loading diff…