PatchGap
Firefox · DOM

CVE-2024-11691

OOB in DOM
High firefox OOB 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionCertain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and memory corruption due to a flaw in Apple's GPU driver. <br>*This bug only affected the application on Apple M series hardware. Other platforms were unaffected.*
ComponentDOM
Bug ClassOOB
Tracker1924184
Fix commit8d3328066d4e (firefox) +2/-6
CISA KEVNot listed
CreditedDohyun Lee (@l33d0hyun) of USELab, Korea University & Youngho Choi of CEL, Korea University & Geumhwan Cho of USELab, Korea University
Disclosed2024-11-26

Files Changed

  • dom/canvas/WebGLContextVertices.cpp

Patch

view commit
diff --git a/dom/canvas/WebGLContextVertices.cpp b/dom/canvas/WebGLContextVertices.cpp
index cd2fbc51b2d..2d27dcfcb4e 100644
--- a/dom/canvas/WebGLContextVertices.cpp
+++ b/dom/canvas/WebGLContextVertices.cpp
@@ -90,10 +90,9 @@ void WebGLContext::EnableVertexAttribArray(GLuint index) {
 
   if (!ValidateAttribIndex(*this, index)) return;
 
-  gl->fEnableVertexAttribArray(index);
-
   MOZ_ASSERT(mBoundVertexArray);
   mBoundVertexArray->SetAttribIsArray(index, true);
+  mBoundVertexArray->DoVertexAttrib(index);
 }
 
 void WebGLContext::DisableVertexAttribArray(GLuint index) {
@@ -102,12 +101,9 @@ void WebGLContext::DisableVertexAttribArray(GLuint index) {
 
   if (!ValidateAttribIndex(*this, index)) return;
 
-  if (index || !gl->IsCompatibilityProfile()) {
-    gl->fDisableVertexAttribArray(index);
-  }
-
   MOZ_ASSERT(mBoundVertexArray);
   mBoundVertexArray->SetAttribIsArray(index, false);
+  mBoundVertexArray->DoVertexAttrib(index);
 }
 
 Maybe<double> WebGLContext::GetVertexAttrib(GLuint index, GLenum pname) {
Loading diff…
On This Page