Firefox · Graphics
CVE-2026-4725
UAF in Graphics
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifgfx/layers/ipc/CanvasTranslator.cpp |
modified |
Files Changed
gfx/layers/ipc/CanvasTranslator.cpp
Patch
diff --git a/gfx/layers/ipc/CanvasTranslator.cpp b/gfx/layers/ipc/CanvasTranslator.cpp
index a8706981a1b..472774ad5af 100644
--- a/gfx/layers/ipc/CanvasTranslator.cpp
+++ b/gfx/layers/ipc/CanvasTranslator.cpp
@@ -416,17 +416,14 @@ bool CanvasTranslator::SetDataSurfaceBuffer(
DataSurfaceBufferWillChange(aId);
// Finally, change the shmem mapping.
- {
- auto& dataSurfaceShmem = mDataSurfaceShmems[aId];
- dataSurfaceShmem.mShmem = aBufferHandle.Map();
- if (!dataSurfaceShmem.mShmem) {
- // Try clearing out old mappings to see if resource limits were reached.
- DataSurfaceBufferWillChange(0, false);
- // Try mapping one last time.
- dataSurfaceShmem.mShmem = aBufferHandle.Map();
- if (!dataSurfaceShmem.mShmem) {
- return false;
- }
+ mDataSurfaceShmems[aId].mShmem = aBufferHandle.Map();
+ if (!mDataSurfaceShmems[aId].mShmem) {
+ // Try clearing out old mappings to see if resource limits were reached.
+ DataSurfaceBufferWillChange(0, false);
+ // Try mapping one last time.
+ mDataSurfaceShmems[aId].mShmem = aBufferHandle.Map();
+ if (!mDataSurfaceShmems[aId].mShmem) {
+ return false;
}
}
Loading diff…
References
On This Page