High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionIncorrect boundary conditions in the Graphics: WebGPU component
ComponentGraphics
Bug ClassLogic Error
Tracker2022554
Fix commit7a057178644f (firefox) +13/-2
CISA KEVNot listed
CreditedInseo An
Disclosed2026-04-07

Changed Functions

FunctionChangeNotes
switch
gfx/thebes/gfxUtils.cpp
modified
if
gfx/thebes/gfxUtils.cpp
modified

Files Changed

  • gfx/thebes/gfxUtils.cpp
diff --git a/gfx/thebes/gfxUtils.cpp b/gfx/thebes/gfxUtils.cpp
index d5554a2259c..3e5d3749239 100644
--- a/gfx/thebes/gfxUtils.cpp
+++ b/gfx/thebes/gfxUtils.cpp
@@ -1517,17 +1517,28 @@ UniquePtr<uint8_t[]> gfxUtils::GetImageBuffer(gfx::DataSourceSurface* aSurface,
                                               int32_t* outFormat) {
   *outFormat = 0;
 
+  auto surfaceFormat = aSurface->GetFormat();
+  switch (surfaceFormat) {
+    case gfx::SurfaceFormat::B8G8R8A8:
+    case gfx::SurfaceFormat::B8G8R8X8:
+      break;
+    default:
+      MOZ_CRASH("Unexpected SurfaceFormat");
+  }
+  auto bpp = 4;
+
   DataSourceSurface::MappedSurface map;
   if (!aSurface->Map(DataSourceSurface::MapType::READ, &map)) return nullptr;
 
   uint32_t bufferSize =
-      aSurface->GetSize().width * aSurface->GetSize().height * 4;
+      aSurface->GetSize().width * aSurface->GetSize().height * bpp;
   auto imageBuffer = MakeUniqueFallible<uint8_t[]>(bufferSize);
   if (!imageBuffer) {
     aSurface->Unmap();
     return nullptr;
   }
-  memcpy(imageBuffer.get(), map.mData, bufferSize);
+  CopySurfaceDataToPackedArray(map.mData, imageBuffer.get(),
+                               aSurface->GetSize(), map.mStride, bpp);
 
   aSurface->Unmap();
 
Loading diff…