Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionIncorrect boundary conditions in the Graphics: Text component
ComponentGraphics
Bug ClassLogic Error
Tracker2016367
Fix commit066038a7c74a (firefox) +1/-1
CISA KEVNot listed
CreditedSajeeb Lohani
Disclosed2026-03-24

Changed Functions

FunctionChangeNotes
if
gfx/2d/ScaledFontMac.cpp
modified

Files Changed

  • gfx/2d/ScaledFontMac.cpp
diff --git a/gfx/2d/ScaledFontMac.cpp b/gfx/2d/ScaledFontMac.cpp
index 6bfbcfe519a..d7bb972df49 100644
--- a/gfx/2d/ScaledFontMac.cpp
+++ b/gfx/2d/ScaledFontMac.cpp
@@ -784,7 +784,7 @@ cairo_font_face_t* ScaledFontMac::CreateCairoFontFace(
 
 already_AddRefed<UnscaledFont> UnscaledFontMac::CreateFromFontDescriptor(
     const uint8_t* aData, uint32_t aDataLength, uint32_t aIndex) {
-  if (aDataLength == 0) {
+  if (aDataLength == 0 || aIndex > aDataLength) {
     gfxWarning() << "Mac font descriptor is truncated.";
     return nullptr;
   }
Loading diff…