High firefox Uninitialized Memory 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUninitialized memory in the Audio/Video: Web Codecs component
ComponentDOM
Bug ClassUninitialized Memory
Tracker2022604
Fix commit71cd3b8ff623 (firefox) +17/-11
CISA KEVNot listed
CreditedInseo An
Disclosed2026-04-21

Changed Functions

FunctionChangeNotes
switch
dom/media/webcodecs/VideoFrame.cpp
modified

Files Changed

  • dom/media/webcodecs/VideoFrame.cpp
diff --git a/dom/media/webcodecs/VideoFrame.cpp b/dom/media/webcodecs/VideoFrame.cpp
index 6bc463f84ac..13a51b9aa12 100644
--- a/dom/media/webcodecs/VideoFrame.cpp
+++ b/dom/media/webcodecs/VideoFrame.cpp
@@ -2823,11 +2823,11 @@ bool VideoFrame::Resource::CopyTo(const Format::Plane& aPlane,
     return false;
   }
 
-  auto copyPlane = [&](const uint8_t* aPlaneData) {
+  auto copyPlane = [&](const uint8_t* aPlaneData, int32_t aSourceStride) {
     MOZ_ASSERT(aPlaneData);
 
     CheckedInt<size_t> offset(aRect.Y());
-    offset *= Stride(aPlane);
+    offset *= aSourceStride;
     offset += aRect.X() * mFormat->SampleBytes(aPlane);
     if (!offset.isValid()) {
       return false;
@@ -2842,9 +2842,9 @@ bool VideoFrame::Resource::CopyTo(const Format::Plane& aPlane,
     aPlaneData += offset.value();
     for (int32_t row = 0; row < aRect.Height(); ++row) {
       PodCopy(aPlaneDest.data(), aPlaneData, elementsBytes.value());
-      aPlaneData += Stride(aPlane);
+      aPlaneData += aSourceStride;
       // Spec asks to move `aDestinationStride` bytes instead of
-      // `Stride(aPlane)` forward.
+      // `aSourceStride` forward.
       aPlaneDest = aPlaneDest.From(aDestinationStride);
     }
     return true;
@@ -2853,16 +2853,20 @@ bool VideoFrame::Resource::CopyTo(const Format::Plane& aPlane,
   if (mImage->GetFormat() == ImageFormat::PLANAR_YCBCR) {
     switch (aPlane) {
       case Format::Plane::Y:
-        return copyPlane(mImage->AsPlanarYCbCrImage()->GetData()->mYChannel);
+        return copyPlane(mImage->AsPlanarYCbCrImage()->GetData()->mYChannel,
+                         Stride(aPlane));
       case Format::Plane::U:
-        return copyPlane(mImage->AsPlanarYCbCrImage()->GetData()->mCbChannel);
+        return copyPlane(mImage->AsPlanarYCbCrImage()->GetData()->mCbChannel,
+                         Stride(aPlane));
       case Format::Plane::V:
-        return copyPlane(mImage->AsPlanarYCbCrImage()->GetData()->mCrChannel);
+        return copyPlane(mImage->AsPlanarYCbCrImage()->GetData()->mCrChannel,
+                         Stride(aPlane));
       case Format::Plane::A:
         MOZ_ASSERT(mFormat->PixelFormat() == VideoPixelFormat::I420A);
         MOZ_ASSERT(mImage->AsPlanarYCbCrImage()->GetData()->mAlpha);
         return copyPlane(
-            mImage->AsPlanarYCbCrImage()->GetData()->mAlpha->mChannel);
+            mImage->AsPlanarYCbCrImage()->GetData()->mAlpha->mChannel,
+            Stride(aPlane));
     }
     MOZ_ASSERT_UNREACHABLE("invalid plane");
   }
@@ -2870,9 +2874,11 @@ bool VideoFrame::Resource::CopyTo(const Format::Plane& aPlane,
   if (mImage->GetFormat() == ImageFormat::NV_IMAGE) {
     switch (aPlane) {
       case Format::Plane::Y:
-        return copyPlane(mImage->AsNVImage()->GetData()->mYChannel);
+        return copyPlane(mImage->AsNVImage()->GetData()->mYChannel,
+                         Stride(aPlane));
       case Format::Plane::UV:
-        return copyPlane(mImage->AsNVImage()->GetData()->mCbChannel);
+        return copyPlane(mImage->AsNVImage()->GetData()->mCbChannel,
+                         Stride(aPlane));
       case Format::Plane::V:
       case Format::Plane::A:
         MOZ_ASSERT_UNREACHABLE("invalid plane");
@@ -2946,7 +2952,7 @@ bool VideoFrame::Resource::CopyTo(const Format::Plane& aPlane,
     return false;
   }
 
-  return copyPlane(tempMap.GetData());
+  return copyPlane(tempMap.GetData(), tempMap.GetStride());
 }
 
 #undef LOGW
Loading diff…