High firefox Memory Corruption 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionMemory safety bugs present in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentDOM
Bug ClassMemory Corruption
Tracker1983838
Fix commitd405025f1904 (firefox) +18/-0
CISA KEVNot listed
CreditedThe Mozilla Fuzzing Team
Disclosed2025-10-14

Files Changed

  • dom/canvas/WebGLTexelConversions.h
diff --git a/dom/canvas/WebGLTexelConversions.h b/dom/canvas/WebGLTexelConversions.h
index 4d5d54ce87b..3ceee155a20 100644
--- a/dom/canvas/WebGLTexelConversions.h
+++ b/dom/canvas/WebGLTexelConversions.h
@@ -1395,6 +1395,24 @@ MOZ_ALWAYS_INLINE void convertType<float, uint8_t>(const float* __restrict src,
   dst[3] = uint8_t(src[3] * scaleFactor);
 }
 
+template <>
+MOZ_ALWAYS_INLINE void convertType<uint16_t, float>(
+    const uint16_t* __restrict src, float* __restrict dst) {
+  dst[0] = unpackFromFloat16(src[0]);
+  dst[1] = unpackFromFloat16(src[1]);
+  dst[2] = unpackFromFloat16(src[2]);
+  dst[3] = unpackFromFloat16(src[3]);
+}
+
+template <>
+MOZ_ALWAYS_INLINE void convertType<float, uint16_t>(const float* __restrict src,
+                                                    uint16_t* __restrict dst) {
+  dst[0] = packToFloat16(src[0]);
+  dst[1] = packToFloat16(src[1]);
+  dst[2] = packToFloat16(src[2]);
+  dst[3] = packToFloat16(src[3]);
+}
+
 template <>
 MOZ_ALWAYS_INLINE void convertType<uint8_t, uint16_t>(
     const uint8_t* __restrict src, uint16_t* __restrict dst) {
Loading diff…