PatchGap
Firefox · Graphics

CVE-2026-74988

Memory Corruption in Graphics
High firefox Memory Corruption 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionInternally found bugs present in Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited.
ComponentGraphics
Bug ClassMemory Corruption
Tracker2045796
Fix commit2500ad5c8ac7 (firefox) +30/-2
CISA KEVNot listed
CreditedGabriele Svelto, Tom Ritter, Tom Schuster and the Mozilla Fuzzing Team
Disclosed2026-08-18

Files Changed

  • gfx/cairo/README
  • gfx/cairo/libpixman/src/pixman-edge-imp.h
  • gfx/cairo/pixman-edge-saturate.patch

Patch

view commit
diff --git a/gfx/cairo/README b/gfx/cairo/README
index 0f733eebee9..16fba512702 100644
--- a/gfx/cairo/README
+++ b/gfx/cairo/README
@@ -43,3 +43,5 @@ pixman-interp.patch: use lower quality interpolation by default on mobile
 pixman-rename.patch: include pixman-rename.h for renaming of external symbols
 
 pixman-translation-round-in-wide.patch: Round translation distances in 48/16 fixpoint.
+
+pixman-edge-saturate.patch: Saturate when rounding up trapezoid edges
diff --git a/gfx/cairo/libpixman/src/pixman-edge-imp.h b/gfx/cairo/libpixman/src/pixman-edge-imp.h
index a4698eddb28..39e8d71d256 100644
--- a/gfx/cairo/libpixman/src/pixman-edge-imp.h
+++ b/gfx/cairo/libpixman/src/pixman-edge-imp.h
@@ -53,10 +53,13 @@ RASTERIZE_EDGES (pixman_image_t  *image,
 	 * when the sample point lies exactly on the line, we round towards
 	 * north-west.
 	 *
+	 * Use 64 bits to get a saturating add, in case lx or rx are near
+	 * the limits of pixman_fixed_t.
+	 *
 	 * (The AA case does a similar  adjustment in RENDER_SAMPLES_X)
 	 */
-	lx += X_FRAC_FIRST(1) - pixman_fixed_e;
-	rx += X_FRAC_FIRST(1) - pixman_fixed_e;
+	lx = (pixman_fixed_t) MIN ((int64_t) lx + (X_FRAC_FIRST(1) - pixman_fixed_e), INT32_MAX);
+	rx = (pixman_fixed_t) MIN ((int64_t) rx + (X_FRAC_FIRST(1) - pixman_fixed_e), INT32_MAX);
 #endif
 	/* clip X */
 	if (lx < 0)
diff --git a/gfx/cairo/pixman-edge-saturate.patch b/gfx/cairo/pixman-edge-saturate.patch
new file mode 100644
index 00000000000..bb6fe0afa67
--- /dev/null
+++ b/gfx/cairo/pixman-edge-saturate.patch
@@ -0,0 +1,23 @@
+From: Jim Blandy <[email protected]>
+Subject: Saturate when rounding up trapezoid edges
+
+diff --git a/gfx/cairo/libpixman/src/pixman-edge-imp.h b/gfx/cairo/libpixman/src/pixman-edge-imp.h
+index a4698eddb281..39e8d71d2568 100644
+--- a/gfx/cairo/libpixman/src/pixman-edge-imp.h
++++ b/gfx/cairo/libpixman/src/pixman-edge-imp.h
+@@ -53,10 +53,13 @@ RASTERIZE_EDGES (pixman_image_t  *image,
+ 	 * when the sample point lies exactly on the line, we round towards
+ 	 * north-west.
+ 	 *
++	 * Use 64 bits to get a saturating add, in case lx or rx are near
++	 * the limits of pixman_fixed_t.
++	 *
+ 	 * (The AA case does a similar  adjustment in RENDER_SAMPLES_X)
+ 	 */
+-	lx += X_FRAC_FIRST(1) - pixman_fixed_e;
+-	rx += X_FRAC_FIRST(1) - pixman_fixed_e;
++	lx = (pixman_fixed_t) MIN ((int64_t) lx + (X_FRAC_FIRST(1) - pixman_fixed_e), INT32_MAX);
++	rx = (pixman_fixed_t) MIN ((int64_t) rx + (X_FRAC_FIRST(1) - pixman_fixed_e), INT32_MAX);
+ #endif
+ 	/* clip X */
+ 	if (lx < 0)
Loading diff…
On This Page