Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionDenial-of-service due to out-of-memory in the Graphics: WebRender component.
ComponentGraphics
Bug ClassLogic Error
Tracker1975837
Fix commitb7885fbd8611 (firefox) +9/-2
CISA KEVNot listed
CreditedIrvan Kurniawan
Disclosed2025-08-19

Files Changed

  • gfx/wr/swgl/src/gl.cc
  • gfx/wr/swgl/src/texture.h
diff --git a/gfx/wr/swgl/src/gl.cc b/gfx/wr/swgl/src/gl.cc
index f76f46ac059..69f93cfe364 100644
--- a/gfx/wr/swgl/src/gl.cc
+++ b/gfx/wr/swgl/src/gl.cc
@@ -88,6 +88,12 @@ WINBASEAPI BOOL WINAPI QueryPerformanceFrequency(LARGE_INTEGER* lpFrequency);
 #  define IMPLICIT
 #endif
 
+#if defined(_MSC_VER)
+#  define ALIGNED_DECL(_align, _type) __declspec(align(_align)) _type
+#else
+#  define ALIGNED_DECL(_align, _type) _type __attribute__((aligned(_align)))
+#endif
+
 #include "gl_defs.h"
 #include "glsl.h"
 #include "program.h"
diff --git a/gfx/wr/swgl/src/texture.h b/gfx/wr/swgl/src/texture.h
index d9b88bfbf19..2f0a2ab55b0 100644
--- a/gfx/wr/swgl/src/texture.h
+++ b/gfx/wr/swgl/src/texture.h
@@ -356,8 +356,9 @@ constexpr int MAX_TEXEL_OFFSET = 8;
 
 // Fill texelFetchOffset outside the valid texture bounds with zeroes. The
 // stride will be set to 0 so that only one row of zeroes is needed.
-static const uint32_t
-    zeroFetchBuf[MAX_TEXEL_OFFSET * sizeof(Float) / sizeof(uint32_t)] = {0};
+ALIGNED_DECL(
+    16, static const uint32_t zeroFetchBuf[MAX_TEXEL_OFFSET * sizeof(Float) /
+                                           sizeof(uint32_t)]) = {0};
 
 struct FetchScalar {
   const uint32_t* buf;
Loading diff…