Firefox · DOM
CVE-2026-92007
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/canvas/WebGLContextVertices.cpp
Patch
diff --git a/dom/canvas/WebGLContextVertices.cpp b/dom/canvas/WebGLContextVertices.cpp
index ad5bd7dddeb..64553deaba6 100644
--- a/dom/canvas/WebGLContextVertices.cpp
+++ b/dom/canvas/WebGLContextVertices.cpp
@@ -3,6 +3,7 @@
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
#include <bit>
+#include <limits>
#include "GLContext.h"
#include "WebGLBuffer.h"
@@ -147,6 +148,11 @@ CheckVertexAttribPointer(const bool isWebgl2,
"Channel count `size` must be within [1,4]."});
}
+ if (desc.byteOffset > std::numeric_limits<int64_t>::max()) {
+ return Err(webgl::ErrorInfo{LOCAL_GL_INVALID_VALUE,
+ "`byteOffset` must be non-negative."});
+ }
+
////
webgl::VertAttribPointerCalculated calc;
Loading diff…
References
On This Page