Firefox · Graphics
CVE-2026-74970
Logic Error in Graphics
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
gfx/layers/ipc/CompositorBridgeParent.cppgfx/layers/ipc/CompositorBridgeParent.hgfx/layers/wr/WebRenderBridgeParent.cpp
Patch
diff --git a/gfx/layers/ipc/CompositorBridgeParent.cpp b/gfx/layers/ipc/CompositorBridgeParent.cpp
index 3c3b7234506..89b0220589c 100644
--- a/gfx/layers/ipc/CompositorBridgeParent.cpp
+++ b/gfx/layers/ipc/CompositorBridgeParent.cpp
@@ -157,6 +157,11 @@ bool CompositorBridgeParentBase::OwnsExternalImageId(
return mNamespace == static_cast<uint32_t>(wr::AsUint64(aId) >> 32);
}
+bool CompositorBridgeParentBase::OwnsPipelineId(
+ const wr::PipelineId& aPipelineId) const {
+ return mNamespace == aPipelineId.mNamespace;
+}
+
CompositorBridgeParent::LayerTreeState::LayerTreeState()
: mApzcTreeManagerParent(nullptr),
mApzInputBridgeParent(nullptr),
diff --git a/gfx/layers/ipc/CompositorBridgeParent.h b/gfx/layers/ipc/CompositorBridgeParent.h
index 52f1f2e98c2..e4b5f7be74c 100644
--- a/gfx/layers/ipc/CompositorBridgeParent.h
+++ b/gfx/layers/ipc/CompositorBridgeParent.h
@@ -155,6 +155,8 @@ class CompositorBridgeParentBase : public PCompositorBridgeParent,
bool OwnsExternalImageId(const wr::ExternalImageId& aId) const;
+ bool OwnsPipelineId(const wr::PipelineId& aPipelineId) const;
+
CompositorManagerParent* GetCompositorManager() const {
return mCompositorManager;
}
diff --git a/gfx/layers/wr/WebRenderBridgeParent.cpp b/gfx/layers/wr/WebRenderBridgeParent.cpp
index 8f0090febd3..2ec21fb9c3c 100644
--- a/gfx/layers/wr/WebRenderBridgeParent.cpp
+++ b/gfx/layers/wr/WebRenderBridgeParent.cpp
@@ -1678,6 +1678,10 @@ bool WebRenderBridgeParent::ProcessWebRenderParentCommands(
case WebRenderParentCommand::TOpAddPipelineIdForCompositable: {
const OpAddPipelineIdForCompositable& op =
cmd.get_OpAddPipelineIdForCompositable();
+ if (!GetCompositorBridge()->OwnsPipelineId(op.pipelineId())) {
+ MOZ_ASSERT_UNREACHABLE("Invalid PipelineId!");
+ break;
+ }
AddPipelineIdForCompositable(op.pipelineId(), op.handle(), op.owner(),
aTxn, txnForImageBridge);
@@ -1686,6 +1690,10 @@ bool WebRenderBridgeParent::ProcessWebRenderParentCommands(
case WebRenderParentCommand::TOpRemovePipelineIdForCompositable: {
const OpRemovePipelineIdForCompositable& op =
cmd.get_OpRemovePipelineIdForCompositable();
+ if (!GetCompositorBridge()->OwnsPipelineId(op.pipelineId())) {
+ MOZ_ASSERT_UNREACHABLE("Invalid PipelineId!");
+ break;
+ }
auto* pendingOps =
mLateInit->mApi->GetPendingAsyncImagePipelineOps(aTxn);
@@ -1701,6 +1709,10 @@ bool WebRenderBridgeParent::ProcessWebRenderParentCommands(
case WebRenderParentCommand::TOpUpdateAsyncImagePipeline: {
const OpUpdateAsyncImagePipeline& op =
cmd.get_OpUpdateAsyncImagePipeline();
+ if (!GetCompositorBridge()->OwnsPipelineId(op.pipelineId())) {
+ MOZ_ASSERT_UNREACHABLE("Invalid PipelineId!");
+ break;
+ }
auto* pendingOps =
mLateInit->mApi->GetPendingAsyncImagePipelineOps(aTxn);
@@ -1719,6 +1731,10 @@ bool WebRenderBridgeParent::ProcessWebRenderParentCommands(
case WebRenderParentCommand::TOpUpdatedAsyncImagePipeline: {
const OpUpdatedAsyncImagePipeline& op =
cmd.get_OpUpdatedAsyncImagePipeline();
+ if (!GetCompositorBridge()->OwnsPipelineId(op.pipelineId())) {
+ MOZ_ASSERT_UNREACHABLE("Invalid PipelineId!");
+ break;
+ }
aTxn.InvalidateRenderedFrame(wr::RenderReasons::ASYNC_IMAGE);
Loading diff…
References
On This Page