Firefox · Graphics
CVE-2026-74940
UAF in Graphics
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifgfx/thebes/CoreTextFontList.cpp |
modified | |
ifgfx/thebes/gfxDWriteFontList.cpp |
modified | |
ifgfx/thebes/gfxFT2FontList.cpp |
modified |
Files Changed
gfx/thebes/CoreTextFontList.cppgfx/thebes/gfxDWriteFontList.cppgfx/thebes/gfxFT2FontList.cpp
Patch
diff --git a/gfx/thebes/CoreTextFontList.cpp b/gfx/thebes/CoreTextFontList.cpp
index 196f90ef01d..459abdb76f3 100644
--- a/gfx/thebes/CoreTextFontList.cpp
+++ b/gfx/thebes/CoreTextFontList.cpp
@@ -374,12 +374,17 @@ nsresult CTFontEntry::ReadCMAP(FontInfoData* aFontInfoData) {
}
gfxFont* CTFontEntry::CreateFontInstance(const gfxFontStyle* aFontStyle) {
- RefPtr<UnscaledFontMac> unscaledFont(mUnscaledFont);
+ RefPtr<UnscaledFontMac> unscaledFont;
+ {
+ AutoReadLock lock(mLock);
+ unscaledFont = RefPtr<UnscaledFontMac>(mUnscaledFont);
+ }
if (!unscaledFont) {
CGFontRef baseFont = GetFontRef();
if (!baseFont) {
return nullptr;
}
+ AutoWriteLock lock(mLock);
unscaledFont = new UnscaledFontMac(baseFont, mIsDataUserFont);
mUnscaledFont = unscaledFont;
}
diff --git a/gfx/thebes/gfxDWriteFontList.cpp b/gfx/thebes/gfxDWriteFontList.cpp
index e303b149635..6a3cbfd64ee 100644
--- a/gfx/thebes/gfxDWriteFontList.cpp
+++ b/gfx/thebes/gfxDWriteFontList.cpp
@@ -706,7 +706,11 @@ gfxFont* gfxDWriteFontEntry::CreateFontInstance(
useBoldSim ? DWRITE_FONT_SIMULATIONS_BOLD : DWRITE_FONT_SIMULATIONS_NONE;
ThreadSafeWeakPtr<UnscaledFontDWrite>& unscaledFontPtr =
useBoldSim ? mUnscaledFontBold : mUnscaledFont;
- RefPtr<UnscaledFontDWrite> unscaledFont(unscaledFontPtr);
+ RefPtr<UnscaledFontDWrite> unscaledFont;
+ {
+ AutoReadLock lock(mLock);
+ unscaledFont = RefPtr<UnscaledFontDWrite>((unscaledFontPtr);
+ }
if (!unscaledFont) {
RefPtr<IDWriteFontFace> fontFace;
nsresult rv =
@@ -714,6 +718,7 @@ gfxFont* gfxDWriteFontEntry::CreateFontInstance(
if (NS_FAILED(rv)) {
return nullptr;
}
+ AutoWriteLock lock(mLock);
// Only pass in the underlying IDWriteFont if the unscaled font doesn't
// reflect a data font. This signals whether or not we can safely query
// a descriptor to represent the font for various transport use-cases.
diff --git a/gfx/thebes/gfxFT2FontList.cpp b/gfx/thebes/gfxFT2FontList.cpp
index ff0f22222be..bdbfa7f2cb5 100644
--- a/gfx/thebes/gfxFT2FontList.cpp
+++ b/gfx/thebes/gfxFT2FontList.cpp
@@ -226,8 +226,13 @@ gfxFont* FT2FontEntry::CreateFontInstance(const gfxFontStyle* aStyle) {
loadFlags &= ~FT_LOAD_NO_AUTOHINT;
}
- RefPtr<UnscaledFontFreeType> unscaledFont(mUnscaledFont);
+ RefPtr<UnscaledFontFreeType> unscaledFont;
+ {
+ AutoReadLock lock(mLock);
+ unscaledFont = RefPtr<UnscaledFontFreeType>(mUnscaledFont);
+ }
if (!unscaledFont) {
+ AutoWriteLock lock(mLock);
RefPtr<SharedFTFace> origFace(mFTFace);
unscaledFont = !mFilename.IsEmpty() && mFilename[0] == '/'
? new UnscaledFontFreeType(mFilename.get(), mFTFontIndex,
Loading diff…
References
On This Page