High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionInformation disclosure due to incorrect boundary conditions in the Audio/Video component
ComponentDOM
Bug ClassLogic Error
Tracker2027433
Fix commit66f216869d62 (firefox) +15/-8
CISA KEVNot listed
CreditedXuehao Guo
Disclosed2026-04-28

Changed Functions

FunctionChangeNotes
for
dom/media/AudioSegment.h
modified
if
dom/media/AudioSegment.h
modified

Files Changed

  • dom/media/AudioSegment.h
diff --git a/dom/media/AudioSegment.h b/dom/media/AudioSegment.h
index 68fbb9d68f2..c64e48f27ae 100644
--- a/dom/media/AudioSegment.h
+++ b/dom/media/AudioSegment.h
@@ -75,14 +75,21 @@ const uint32_t WEBAUDIO_BLOCK_SIZE = 1 << WEBAUDIO_BLOCK_SIZE_BITS;
 template <typename SrcT, typename DestT>
 static void InterleaveAndConvertBuffer(const SrcT* const* aSourceChannels,
                                        uint32_t aLength, float aVolume,
-                                       uint32_t aChannels, DestT* aOutput) {
-  DestT* output = aOutput;
-  for (size_t i = 0; i < aLength; ++i) {
-    for (size_t channel = 0; channel < aChannels; ++channel) {
-      float v =
-          ConvertAudioSample<float>(aSourceChannels[channel][i]) * aVolume;
-      *output = FloatToAudioSample<DestT>(v);
-      ++output;
+                                       uint32_t aChannelCount, DestT* aOutput) {
+  for (size_t channel = 0; channel < aChannelCount; ++channel) {
+    DestT* output = aOutput + channel;
+    if (aSourceChannels[channel]) {
+      for (size_t i = 0; i < aLength; ++i) {
+        float v =
+            ConvertAudioSample<float>(aSourceChannels[channel][i]) * aVolume;
+        *output = FloatToAudioSample<DestT>(v);
+        output += aChannelCount;
+      }
+    } else {
+      for (size_t i = 0; i < aLength; ++i) {
+        *output = static_cast<DestT>(0);
+        output += aChannelCount;
+      }
     }
   }
 }
Loading diff…