High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionPrivilege escalation due to incorrect boundary conditions in the Graphics component
ComponentGraphics
Bug ClassLogic Error
Tracker2068456
Fix commit5dc20810c0d1 (firefox) +3/-3
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-29

Files Changed

  • gfx/thebes/gfxOTSUtils.h
diff --git a/gfx/thebes/gfxOTSUtils.h b/gfx/thebes/gfxOTSUtils.h
index b5ebb8db482..4baa7385a92 100644
--- a/gfx/thebes/gfxOTSUtils.h
+++ b/gfx/thebes/gfxOTSUtils.h
@@ -28,9 +28,9 @@ class gfxOTSExpandingMemoryStream : public ots::OTSStream {
 
   explicit gfxOTSExpandingMemoryStream(size_t initial,
                                        size_t limit = DEFAULT_LIMIT)
-      : mLength(initial), mLimit(limit), mOff(0) {
-    mPtr = mAlloc.Grow(nullptr, initial);
-    std::memset(mPtr, 0, initial);
+      : mLength(initial < limit ? initial : limit), mLimit(limit), mOff(0) {
+    mPtr = mAlloc.Grow(nullptr, mLength);
+    std::memset(mPtr, 0, mLength);
   }
 
   ~gfxOTSExpandingMemoryStream() { mAlloc.Free(mPtr); }
Loading diff…