Firefox · Graphics
CVE-2026-5733
Logic Error in Graphics
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
switchgfx/thebes/gfxUtils.cpp |
modified | |
ifgfx/thebes/gfxUtils.cpp |
modified |
Files Changed
gfx/thebes/gfxUtils.cpp
Patch
diff --git a/gfx/thebes/gfxUtils.cpp b/gfx/thebes/gfxUtils.cpp
index d5554a2259c..3e5d3749239 100644
--- a/gfx/thebes/gfxUtils.cpp
+++ b/gfx/thebes/gfxUtils.cpp
@@ -1517,17 +1517,28 @@ UniquePtr<uint8_t[]> gfxUtils::GetImageBuffer(gfx::DataSourceSurface* aSurface,
int32_t* outFormat) {
*outFormat = 0;
+ auto surfaceFormat = aSurface->GetFormat();
+ switch (surfaceFormat) {
+ case gfx::SurfaceFormat::B8G8R8A8:
+ case gfx::SurfaceFormat::B8G8R8X8:
+ break;
+ default:
+ MOZ_CRASH("Unexpected SurfaceFormat");
+ }
+ auto bpp = 4;
+
DataSourceSurface::MappedSurface map;
if (!aSurface->Map(DataSourceSurface::MapType::READ, &map)) return nullptr;
uint32_t bufferSize =
- aSurface->GetSize().width * aSurface->GetSize().height * 4;
+ aSurface->GetSize().width * aSurface->GetSize().height * bpp;
auto imageBuffer = MakeUniqueFallible<uint8_t[]>(bufferSize);
if (!imageBuffer) {
aSurface->Unmap();
return nullptr;
}
- memcpy(imageBuffer.get(), map.mData, bufferSize);
+ CopySurfaceDataToPackedArray(map.mData, imageBuffer.get(),
+ aSurface->GetSize(), map.mStride, bpp);
aSurface->Unmap();
Loading diff…
References
On This Page