High firefox Sandbox Escape 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
ComponentDOM
Bug ClassSandbox Escape
Tracker1996473
Fix commit0104c6562a3e (firefox) +11/-1
CISA KEVNot listed
CreditedOskar L
Disclosed2025-12-09

Changed Functions

FunctionChangeNotes
if
dom/canvas/TexUnpackBlob.cpp
modified

Files Changed

  • dom/canvas/TexUnpackBlob.cpp
diff --git a/dom/canvas/TexUnpackBlob.cpp b/dom/canvas/TexUnpackBlob.cpp
index fdda98ec2db..00826c13fc7 100644
--- a/dom/canvas/TexUnpackBlob.cpp
+++ b/dom/canvas/TexUnpackBlob.cpp
@@ -395,7 +395,17 @@ bool TexUnpackBlob::ConvertIfNeeded(
 
   if (!rowLength || !rowCount) return true;
 
-  if (srcStride <= 0 || dstStride <= 0) {
+  auto minSrcStride =
+      CheckedInt<size_t>(
+          WebGLTexelConversions::TexelBytesForFormat(srcFormat)) *
+      rowLength;
+  auto minDstStride =
+      CheckedInt<size_t>(
+          WebGLTexelConversions::TexelBytesForFormat(dstFormat)) *
+      rowLength;
+  if (srcStride <= 0 || dstStride <= 0 || !minSrcStride.isValid() ||
+      !minDstStride.isValid() || size_t(srcStride) < minSrcStride.value() ||
+      size_t(dstStride) < minDstStride.value()) {
     webgl->ErrorInvalidOperation("Invalid stride.");
     return false;
   }
Loading diff…