Firefox · Graphics
CVE-2026-4715
Uninitialized Memory in Graphics
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifgfx/2d/FilterNodeSoftware.cpp |
modified | |
forgfx/2d/FilterNodeSoftware.cpp |
modified | |
switchgfx/2d/FilterNodeSoftware.cpp |
modified |
Files Changed
gfx/2d/FilterNodeSoftware.cppgfx/2d/FilterNodeSoftware.h
Patch
diff --git a/gfx/2d/FilterNodeSoftware.cpp b/gfx/2d/FilterNodeSoftware.cpp
index 1b66cf50a3f..ec6c3672617 100644
--- a/gfx/2d/FilterNodeSoftware.cpp
+++ b/gfx/2d/FilterNodeSoftware.cpp
@@ -1765,12 +1765,10 @@ void FilterNodeComponentTransferSoftware::SetAttribute(uint32_t aIndex,
void FilterNodeComponentTransferSoftware::GenerateLookupTable(
ptrdiff_t aComponent, uint8_t aTables[4][256], bool aDisabled) {
- if (aDisabled) {
+ if (aDisabled || !FillLookupTable(aComponent, aTables[aComponent])) {
for (int32_t i = 0; i < 256; ++i) {
aTables[aComponent][i] = i;
}
- } else {
- FillLookupTable(aComponent, aTables[aComponent]);
}
}
@@ -1927,32 +1925,28 @@ void FilterNodeTableTransferSoftware::SetAttribute(uint32_t aIndex,
Invalidate();
}
-void FilterNodeTableTransferSoftware::FillLookupTable(ptrdiff_t aComponent,
+bool FilterNodeTableTransferSoftware::FillLookupTable(ptrdiff_t aComponent,
uint8_t aTable[256]) {
switch (aComponent) {
case B8G8R8A8_COMPONENT_BYTEOFFSET_R:
- FillLookupTableImpl(mTableR, aTable);
- break;
+ return FillLookupTableImpl(mTableR, aTable);
case B8G8R8A8_COMPONENT_BYTEOFFSET_G:
- FillLookupTableImpl(mTableG, aTable);
- break;
+ return FillLookupTableImpl(mTableG, aTable);
case B8G8R8A8_COMPONENT_BYTEOFFSET_B:
- FillLookupTableImpl(mTableB, aTable);
- break;
+ return FillLookupTableImpl(mTableB, aTable);
case B8G8R8A8_COMPONENT_BYTEOFFSET_A:
- FillLookupTableImpl(mTableA, aTable);
- break;
+ return FillLookupTableImpl(mTableA, aTable);
default:
MOZ_ASSERT(false, "unknown component");
- break;
+ return false;
}
}
-void FilterNodeTableTransferSoftware::FillLookupTableImpl(
+bool FilterNodeTableTransferSoftware::FillLookupTableImpl(
const std::vector<Float>& aTableValues, uint8_t aTable[256]) {
uint32_t tvLength = aTableValues.size();
- if (tvLength < 2) {
- return;
+ if (tvLength < 1) {
+ return false;
}
for (size_t i = 0; i < 256; i++) {
@@ -1963,6 +1957,7 @@ void FilterNodeTableTransferSoftware::FillLookupTableImpl(
(tvLength - 1) * (v2 - v1)));
aTable[i] = std::clamp(val, 0, 255);
}
+ return true;
}
void FilterNodeDiscreteTransferSoftware::SetAttribute(uint32_t aIndex,
@@ -1988,32 +1983,28 @@ void FilterNodeDiscreteTransferSoftware::SetAttribute(uint32_t aIndex,
Invalidate();
}
-void FilterNodeDiscreteTransferSoftware::FillLookupTable(ptrdiff_t aComponent,
+bool FilterNodeDiscreteTransferSoftware::FillLookupTable(ptrdiff_t aComponent,
uint8_t aTable[256]) {
switch (aComponent) {
case B8G8R8A8_COMPONENT_BYTEOFFSET_R:
- FillLookupTableImpl(mTableR, aTable);
- break;
+ return FillLookupTableImpl(mTableR, aTable);
case B8G8R8A8_COMPONENT_BYTEOFFSET_G:
- FillLookupTableImpl(mTableG, aTable);
- break;
+ return FillLookupTableImpl(mTableG, aTable);
case B8G8R8A8_COMPONENT_BYTEOFFSET_B:
- FillLookupTableImpl(mTableB, aTable);
- break;
+ return FillLookupTableImpl(mTableB, aTable);
case B8G8R8A8_COMPONENT_BYTEOFFSET_A:
- FillLookupTableImpl(mTableA, aTable);
- break;
+ return FillLookupTableImpl(mTableA, aTable);
default:
MOZ_ASSERT(false, "unknown component");
- break;
+ return false;
}
}
-void FilterNodeDiscreteTransferSoftware::FillLookupTableImpl(
+bool FilterNodeDiscreteTransferSoftware::FillLookupTableImpl(
const std::vector<Float>& aTableValues, uint8_t aTable[256]) {
uint32_t tvLength = aTableValues.size();
if (tvLength < 1) {
- return;
+ return false;
}
for (size_t i = 0; i < 256; i++) {
@@ -2023,6 +2014,7 @@ void FilterNodeDiscreteTransferSoftware::FillLookupTableImpl(
int32_t val = NS_lround(255 * v);
aTable[i] = std::clamp(val, 0, 255);
}
+ return true;
}
FilterNodeLinearTransferSoftware::FilterNodeLinearTransferSoftware()
@@ -2068,33 +2060,30 @@ void FilterNodeLinearTransferSoftware::SetAttribute(uint32_t aIndex,
Invalidate();
}
-void FilterNodeLinearTransferSoftware::FillLookupTable(ptrdiff_t aComponent,
+bool FilterNodeLinearTransferSoftware::FillLookupTable(ptrdiff_t aComponent,
uint8_t aTable[256]) {
switch (aComponent) {
case B8G8R8A8_COMPONENT_BYTEOFFSET_R:
- FillLookupTableImpl(mSlopeR, mInterceptR, aTable);
- break;
+ return FillLookupTableImpl(mSlopeR, mInterceptR, aTable);
case B8G8R8A8_COMPONENT_BYTEOFFSET_G:
- FillLookupTableImpl(mSlopeG, mInterceptG, aTable);
- break;
+ return FillLookupTableImpl(mSlopeG, mInterceptG, aTable);
case B8G8R8A8_COMPONENT_BYTEOFFSET_B:
- FillLookupTableImpl(mSlopeB, mInterceptB, aTable);
- break;
+ return FillLookupTableImpl(mSlopeB, mInterceptB, aTable);
case B8G8R8A8_COMPONENT_BYTEOFFSET_A:
- FillLookupTableImpl(mSlopeA, mInterceptA, aTable);
- break;
+ return FillLookupTableImpl(mSlopeA, mInterceptA, aTable);
default:
MOZ_ASSERT(false, "unknown component");
- break;
+ return false;
}
}
-void FilterNodeLinearTransferSoftware::FillLookupTableImpl(
+bool FilterNodeLinearTransferSoftware::FillLookupTableImpl(
Float aSlope, Float aIntercept, uint8_t aTable[256]) {
for (size_t i = 0; i < 256; i++) {
int32_t val = NS_lround(aSlope * i + 255 * aIntercept);
aTable[i] = std::clamp(val, 0, 255);
}
+ return true;
}
FilterNodeGammaTransferSoftware::FilterNodeGammaTransferSoftware()
@@ -2156,28 +2145,24 @@ void FilterNodeGammaTransferSoftware::SetAttribute(uint32_t aIndex,
Invalidate();
}
-void FilterNodeGammaTransferSoftware::FillLookupTable(ptrdiff_t aComponent,
+bool FilterNodeGammaTransferSoftware::FillLookupTable(ptrdiff_t aComponent,
uint8_t aTable[256]) {
switch (aComponent) {
case B8G8R8A8_COMPONENT_BYTEOFFSET_R:
- FillLookupTableImpl(mAmplitudeR, mExponentR, mOffsetR, aTable);
- break;
+ return FillLookupTableImpl(mAmplitudeR, mExponentR, mOffsetR, aTable);
case B8G8R8A8_COMPONENT_BYTEOFFSET_G:
- FillLookupTableImpl(mAmplitudeG, mExponentG, mOffsetG, aTable);
- break;
+ return FillLookupTableImpl(mAmplitudeG, mExponentG, mOffsetG, aTable);
case B8G8R8A8_COMPONENT_BYTEOFFSET_B:
- FillLookupTableImpl(mAmplitudeB, mExponentB, mOffsetB, aTable);
- break;
+ return FillLookupTableImpl(mAmplitudeB, mExponentB, mOffsetB, aTable);
case B8G8R8A8_COMPONENT_BYTEOFFSET_A:
- FillLookupTableImpl(mAmplitudeA, mExponentA, mOffsetA, aTable);
- break;
+ return FillLookupTableImpl(mAmplitudeA, mExponentA, mOffsetA, aTable);
default:
MOZ_ASSERT(false, "unknown component");
- break;
+ return false;
}
}
-void FilterNodeGammaTransferSoftware::FillLookupTableImpl(Float aAmplitude,
+bool FilterNodeGammaTransferSoftware::FillLookupTableImpl(Float aAmplitude,
Float aExponent,
Float aOffset,
uint8_t aTable[256]) {
@@ -2186,6 +2171,7 @@ void FilterNodeGammaTransferSoftware::FillLookupTableImpl(Float aAmplitude,
NS_lround(255 * (aAmplitude * pow(i / 255.0f, aExponent) + aOffset));
aTable[i] = std::clamp(val, 0, 255);
}
+ return true;
Loading diff…
References
On This Page