Firefox · DOM
CVE-2025-14322
Sandbox Escape in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/canvas/TexUnpackBlob.cpp |
modified |
Files Changed
dom/canvas/TexUnpackBlob.cpp
Patch
diff --git a/dom/canvas/TexUnpackBlob.cpp b/dom/canvas/TexUnpackBlob.cpp
index fdda98ec2db..00826c13fc7 100644
--- a/dom/canvas/TexUnpackBlob.cpp
+++ b/dom/canvas/TexUnpackBlob.cpp
@@ -395,7 +395,17 @@ bool TexUnpackBlob::ConvertIfNeeded(
if (!rowLength || !rowCount) return true;
- if (srcStride <= 0 || dstStride <= 0) {
+ auto minSrcStride =
+ CheckedInt<size_t>(
+ WebGLTexelConversions::TexelBytesForFormat(srcFormat)) *
+ rowLength;
+ auto minDstStride =
+ CheckedInt<size_t>(
+ WebGLTexelConversions::TexelBytesForFormat(dstFormat)) *
+ rowLength;
+ if (srcStride <= 0 || dstStride <= 0 || !minSrcStride.isValid() ||
+ !minDstStride.isValid() || size_t(srcStride) < minSrcStride.value() ||
+ size_t(dstStride) < minDstStride.value()) {
webgl->ErrorInvalidOperation("Invalid stride.");
return false;
}
Loading diff…
References
On This Page