Firefox · Graphics
CVE-2026-74945
Logic Error in Graphics
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
gfx/thebes/gfxOTSUtils.h
Patch
diff --git a/gfx/thebes/gfxOTSUtils.h b/gfx/thebes/gfxOTSUtils.h
index b0bb74339b0..b5ebb8db482 100644
--- a/gfx/thebes/gfxOTSUtils.h
+++ b/gfx/thebes/gfxOTSUtils.h
@@ -29,7 +29,8 @@ class gfxOTSExpandingMemoryStream : public ots::OTSStream {
explicit gfxOTSExpandingMemoryStream(size_t initial,
size_t limit = DEFAULT_LIMIT)
: mLength(initial), mLimit(limit), mOff(0) {
- mPtr = mAlloc.Grow(nullptr, mLength);
+ mPtr = mAlloc.Grow(nullptr, initial);
+ std::memset(mPtr, 0, initial);
}
~gfxOTSExpandingMemoryStream() { mAlloc.Free(mPtr); }
@@ -59,6 +60,7 @@ class gfxOTSExpandingMemoryStream : public ots::OTSStream {
newLength = mLimit;
}
mPtr = mAlloc.Grow(mPtr, newLength);
+ std::memset(static_cast<char*>(mPtr) + mLength, 0, newLength - mLength);
mLength = newLength;
return WriteRaw(data, length);
}
Loading diff…
References
On This Page