Firefox · Graphics
CVE-2026-92020
Logic Error in Graphics
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
switchgfx/wr/swgl/src/swgl_ext.h |
modified |
Files Changed
gfx/wr/swgl/src/swgl_ext.h
Patch
diff --git a/gfx/wr/swgl/src/swgl_ext.h b/gfx/wr/swgl/src/swgl_ext.h
index f76feae816e..d2d00207670 100644
--- a/gfx/wr/swgl/src/swgl_ext.h
+++ b/gfx/wr/swgl/src/swgl_ext.h
@@ -1005,6 +1005,17 @@ static ALWAYS_INLINE PackedRGBA8 convertYUV(const YUVMatrix& rgb_from_ycbcr,
return rgb_from_ycbcr.convert(yy, uv);
}
+template <typename S0>
+static inline bool validYUVFormat(S0 sampler0) {
+ switch (sampler0->format) {
+ case TextureFormat::RGBA8:
+ case TextureFormat::YUY2:
+ return true;
+ default:
+ return false;
+ }
+}
+
// Helper functions to sample from planar YUV textures before converting to RGB
template <typename S0>
static ALWAYS_INLINE PackedRGBA8 sampleYUV(S0 sampler0, ivec2 uv0,
@@ -1031,7 +1042,7 @@ static int blendYUV(P* buf, int span, S0 sampler0, vec2 uv0,
const vec4_scalar& uv_rect0, const vec3_scalar& ycbcr_bias,
const mat3_scalar& rgb_from_debiased_ycbcr,
int rescaleFactor, C color = C()) {
- if (!swgl_isTextureLinear(sampler0)) {
+ if (!swgl_isTextureLinear(sampler0) || !validYUVFormat(sampler0)) {
return 0;
}
LINEAR_QUANTIZE_UV(sampler0, uv0, uv_step0, uv_rect0, min_uv0, max_uv0);
@@ -1048,6 +1059,20 @@ static int blendYUV(P* buf, int span, S0 sampler0, vec2 uv0,
return span;
}
+template <typename S0, typename S1>
+static inline bool validYUVFormat(S0 sampler0, S1 sampler1) {
+ switch (sampler1->format) {
+ case TextureFormat::RG8:
+ return sampler0->format == TextureFormat::R8;
+ case TextureFormat::RGBA8:
+ return sampler0->format == TextureFormat::R8;
+ case TextureFormat::RG16:
+ return sampler0->format == TextureFormat::R16;
+ default:
+ return false;
+ }
+}
+
template <typename S0, typename S1>
static ALWAYS_INLINE PackedRGBA8 sampleYUV(S0 sampler0, ivec2 uv0, S1 sampler1,
ivec2 uv1,
@@ -1096,7 +1121,8 @@ static int blendYUV(P* buf, int span, S0 sampler0, vec2 uv0,
const vec4_scalar& uv_rect1, const vec3_scalar& ycbcr_bias,
const mat3_scalar& rgb_from_debiased_ycbcr,
int rescaleFactor, C color = C()) {
- if (!swgl_isTextureLinear(sampler0) || !swgl_isTextureLinear(sampler1)) {
+ if (!swgl_isTextureLinear(sampler0) || !swgl_isTextureLinear(sampler1) ||
+ !validYUVFormat(sampler0, sampler1)) {
return 0;
}
LINEAR_QUANTIZE_UV(sampler0, uv0, uv_step0, uv_rect0, min_uv0, max_uv0);
@@ -1115,6 +1141,18 @@ static int blendYUV(P* buf, int span, S0 sampler0, vec2 uv0,
return span;
}
+template <typename S0, typename S1, typename S2>
+static inline bool validYUVFormat(S0 sampler0, S1 sampler1, S2 sampler2) {
+ switch (sampler0->format) {
+ case TextureFormat::R8:
+ case TextureFormat::R16:
+ return sampler0->format == sampler1->format &&
+ sampler0->format == sampler2->format;
+ default:
+ return false;
+ }
+}
+
template <typename S0, typename S1, typename S2>
static ALWAYS_INLINE PackedRGBA8 sampleYUV(S0 sampler0, ivec2 uv0, S1 sampler1,
ivec2 uv1, S2 sampler2, ivec2 uv2,
@@ -1185,8 +1223,8 @@ static int blendYUV(P* buf, int span, S0 sampler0, vec2 uv0,
const mat3_scalar& rgb_from_debiased_ycbcr,
int rescaleFactor, C color = C()) {
if (!swgl_isTextureLinear(sampler0) || !swgl_isTextureLinear(sampler1) ||
- !swgl_isTextureLinear(sampler2) || sampler0->format != sampler1->format ||
- sampler0->format != sampler2->format) {
+ !swgl_isTextureLinear(sampler2) ||
+ !validYUVFormat(sampler0, sampler1, sampler2)) {
return 0;
}
LINEAR_QUANTIZE_UV(sampler0, uv0, uv_step0, uv_rect0, min_uv0, max_uv0);
@@ -1217,7 +1255,8 @@ static int blendYUV(uint32_t* buf, int span, sampler2DRect sampler0, vec2 uv0,
const mat3_scalar& rgb_from_debiased_ycbcr,
int rescaleFactor, NoColor noColor = NoColor()) {
if (!swgl_isTextureLinear(sampler0) || !swgl_isTextureLinear(sampler1) ||
- !swgl_isTextureLinear(sampler2)) {
+ !swgl_isTextureLinear(sampler2) ||
+ !validYUVFormat(sampler0, sampler1, sampler2)) {
return 0;
}
LINEAR_QUANTIZE_UV(sampler0, uv0, uv_step0, uv_rect0, min_uv0, max_uv0);
Loading diff…
References
On This Page