Firefox · Layout
CVE-2025-6424
UAF in Layout
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
layout/style/FontFaceSet.cpp
Patch
diff --git a/layout/style/FontFaceSet.cpp b/layout/style/FontFaceSet.cpp
index 984bf792211..0891519f866 100644
--- a/layout/style/FontFaceSet.cpp
+++ b/layout/style/FontFaceSet.cpp
@@ -148,7 +148,8 @@ already_AddRefed<Promise> FontFaceSet::Load(JSContext* aCx,
if (aRv.Failed()) {
return nullptr;
}
- if (!faces.AppendElements(weakFaces, fallible)) {
+ if (!faces.AppendElements(weakFaces, fallible) ||
+ !promises.SetCapacity(weakFaces.Length(), fallible)) {
aRv.Throw(NS_ERROR_FAILURE);
return nullptr;
}
@@ -159,10 +160,7 @@ already_AddRefed<Promise> FontFaceSet::Load(JSContext* aCx,
if (aRv.Failed()) {
return nullptr;
}
- if (!promises.AppendElement(promise, fallible)) {
- aRv.Throw(NS_ERROR_FAILURE);
- return nullptr;
- }
+ promises.AppendElement(promise);
}
return Promise::All(aCx, promises, aRv);
Loading diff…
References
On This Page