Firefox · DOM
CVE-2026-74947
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/canvas/DrawTargetWebgl.cpp
Patch
diff --git a/dom/canvas/DrawTargetWebgl.cpp b/dom/canvas/DrawTargetWebgl.cpp
index 19285706498..4bb0e00a8c4 100644
--- a/dom/canvas/DrawTargetWebgl.cpp
+++ b/dom/canvas/DrawTargetWebgl.cpp
@@ -4189,7 +4189,8 @@ already_AddRefed<TextureHandle> SharedContextWebgl::ResolveFilterInputAccel(
const IntRect& aSourceRect, const Matrix& aDestTransform,
const DrawOptions& aOptions, const StrokeOptions* aStrokeOptions,
SurfaceFormat aFormat) {
- if (SupportsDrawOptions(aOptions) != SupportsDrawOptionsStatus::Yes) {
+ if (SupportsDrawOptions(aOptions) != SupportsDrawOptionsStatus::Yes ||
+ !aPath || aPath->GetBackendType() != BackendType::SKIA) {
return nullptr;
}
if (IsContextLost()) {
@@ -6802,6 +6803,9 @@ already_AddRefed<FilterNode> DrawTargetWebgl::DeferFilterInput(
const Path* aPath, const Pattern& aPattern, const IntRect& aSourceRect,
const IntPoint& aDestOffset, const DrawOptions& aOptions,
const StrokeOptions* aStrokeOptions) {
+ if (!aPath || aPath->GetBackendType() != BackendType::SKIA) {
+ return nullptr;
+ }
RefPtr<FilterNode> filter = new FilterNodeDeferInputWebgl(
do_AddRef((Path*)aPath), aPattern, aSourceRect,
GetTransform().PostTranslate(aDestOffset), aOptions, aStrokeOptions);
Loading diff…
References
On This Page