High firefox Uninitialized Memory 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUninitialized memory in the Audio/Video: Web Codecs component
ComponentDOM
Bug ClassUninitialized Memory
Tracker2025883
Fix commit2ff3158f5f13 (firefox) +3/-3
CISA KEVNot listed
CreditedJoren Afman
Disclosed2026-04-21

Changed Functions

FunctionChangeNotes
for
dom/media/webcodecs/AudioData.cpp
modified

Files Changed

  • dom/media/webcodecs/AudioData.cpp
diff --git a/dom/media/webcodecs/AudioData.cpp b/dom/media/webcodecs/AudioData.cpp
index bceea375956..916a6be3df1 100644
--- a/dom/media/webcodecs/AudioData.cpp
+++ b/dom/media/webcodecs/AudioData.cpp
@@ -510,12 +510,12 @@ void CopySamples(Span<S> aSource, Span<D> aDest, uint32_t aSourceChannelCount,
     MOZ_ASSERT(aSource.Length() -
                    aCopyToSpec.mFrameOffset * aSourceChannelCount >=
                aCopyToSpec.mFrameCount * aSourceChannelCount);
+    MOZ_ASSERT(aSource.Length() % aSourceChannelCount == 0);
+    size_t framesPerPlane = aSource.Length() / aSourceChannelCount;
     size_t writeIndex = 0;
-    // Scan the source linearly and put each sample at the right position in the
-    // destination interleaved buffer.
-    size_t readIndex = 0;
     for (size_t channel = 0; channel < aSourceChannelCount; channel++) {
       writeIndex = channel;
+      size_t readIndex = channel * framesPerPlane + aCopyToSpec.mFrameOffset;
       for (size_t i = 0; i < aCopyToSpec.mFrameCount; i++) {
         aDest[writeIndex] = ConvertAudioSample<D>(aSource[readIndex]);
         readIndex++;
Loading diff…