Firefox · Graphics
CVE-2026-0878
Sandbox Escape in Graphics
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
whilegfx/layers/SourceSurfaceSharedData.cpp |
modified |
Files Changed
gfx/layers/SourceSurfaceSharedData.cpp
Patch
diff --git a/gfx/layers/SourceSurfaceSharedData.cpp b/gfx/layers/SourceSurfaceSharedData.cpp
index a6d0d02d7de..57948291382 100644
--- a/gfx/layers/SourceSurfaceSharedData.cpp
+++ b/gfx/layers/SourceSurfaceSharedData.cpp
@@ -79,6 +79,10 @@ void SourceSurfaceSharedDataWrapper::Init(SourceSurfaceSharedData* aSurface) {
bool SourceSurfaceSharedDataWrapper::EnsureMapped(size_t aLength) {
MOZ_ASSERT(!GetData());
+ if (mBufHandle.Size() < aLength) {
+ return false;
+ }
+
auto mapping = mBufHandle.Map();
while (!mapping) {
nsTArray<RefPtr<SourceSurfaceSharedDataWrapper>> expired;
Loading diff…
References
On This Page