Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionInformation disclosure in the Graphics: ImageLib component
ComponentImageLib
Bug ClassLogic Error
Tracker2067971
Fix commite310acdf34b1 (firefox) +10/-6
CISA KEVNot listed
CreditedQi Qin
Disclosed2026-09-15

Changed Functions

FunctionChangeNotes
if
image/decoders/nsJPEGDecoder.cpp
modified
for
image/decoders/nsJPEGDecoder.cpp
modified

Files Changed

  • image/decoders/nsJPEGDecoder.cpp
diff --git a/image/decoders/nsJPEGDecoder.cpp b/image/decoders/nsJPEGDecoder.cpp
index 45349a2ba83..8194ce198e2 100644
--- a/image/decoders/nsJPEGDecoder.cpp
+++ b/image/decoders/nsJPEGDecoder.cpp
@@ -511,13 +511,17 @@ LexerTransition<nsJPEGDecoder::State> nsJPEGDecoder::ReadJPEGData(
       if (mState == JPEG_DECOMPRESS_PROGRESSIVE) {
         LOG_SCOPE((mozilla::LogModule*)sJPEGLog,
                   "nsJPEGDecoder::Write -- JPEG_DECOMPRESS_PROGRESSIVE case");
-        auto AllComponentsSeen = [](jpeg_decompress_struct& info) {
+        auto AllComponentsSeen = [](jpeg_decompress_struct& info) -> bool {
+          // Without coefficient state (lossless, non-interleaved sequential)
+          // we can't prove per-component completion, so require the whole
+          // input before displaying.
+          if (!info.coef_bits) {
+            return jpeg_input_complete(&info);
+          }
           bool all_components_seen = true;
-          if (info.coef_bits) {
-            for (int c = 0; c < info.num_components; ++c) {
-              bool current_component_seen = info.coef_bits[c][0] != -1;
-              all_components_seen &= current_component_seen;
-            }
+          for (int c = 0; c < info.num_components; ++c) {
+            bool current_component_seen = info.coef_bits[c][0] != -1;
+            all_components_seen &= current_component_seen;
           }
           return all_components_seen;
         };
Loading diff…