Firefox · ImageLib
CVE-2026-74943
UAF in ImageLib
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifimage/RasterImage.cpp |
modified |
Files Changed
image/RasterImage.cppimage/RasterImage.h
Patch
diff --git a/image/RasterImage.cpp b/image/RasterImage.cpp
index 25cd5d034db..318d72e061c 100644
--- a/image/RasterImage.cpp
+++ b/image/RasterImage.cpp
@@ -76,8 +76,6 @@ RasterImage::RasterImage(nsIURI* aURI /* = nullptr */)
//******************************************************************************
RasterImage::~RasterImage() {
- mIsBeingDestroyed = true;
-
// Make sure our SourceBuffer is marked as complete. This will ensure that any
// outstanding decoders terminate.
if (!mSourceBuffer->IsComplete()) {
@@ -486,19 +484,21 @@ RasterImage::WillDrawOpaqueNow() {
void RasterImage::OnSurfaceDiscarded(const SurfaceKey& aSurfaceKey) {
MOZ_ASSERT(mProgressTracker);
- if (mIsBeingDestroyed) {
- return;
- }
-
bool animatedFramesDiscarded =
aSurfaceKey.Playback() == PlaybackType::eAnimated;
nsCOMPtr<nsIEventTarget> eventTarget = do_GetMainThread();
- RefPtr<RasterImage> image = this;
- nsCOMPtr<nsIRunnable> ev =
- NS_NewRunnableFunction("RasterImage::OnSurfaceDiscarded", [=]() -> void {
- image->OnSurfaceDiscardedInternal(animatedFramesDiscarded);
+ RefPtr<ProgressTracker> progressTracker = mProgressTracker;
+ nsCOMPtr<nsIRunnable> ev = NS_NewRunnableFunction(
+ "RasterImage::OnSurfaceDiscarded",
+ [progressTracker, animatedFramesDiscarded]() -> void {
+ RefPtr<Image> image = progressTracker->GetImage();
+ if (!image) {
+ return;
+ }
+ static_cast<RasterImage*>(image.get())
+ ->OnSurfaceDiscardedInternal(animatedFramesDiscarded);
});
eventTarget->Dispatch(ev.forget(), NS_DISPATCH_NORMAL);
}
diff --git a/image/RasterImage.h b/image/RasterImage.h
index 7b7bba84196..30e90640dfb 100644
--- a/image/RasterImage.h
+++ b/image/RasterImage.h
@@ -380,8 +380,6 @@ class RasterImage final : public ImageResource,
// This is currently only used for statistics
int32_t mDecodeCount;
- Atomic<bool> mIsBeingDestroyed{false};
-
#ifdef DEBUG
uint32_t mFramesNotified;
#endif
Loading diff…
References
On This Page