Firefox · Media
CVE-2026-109738
Logic Error in Media
Overview
Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
media/ffvpx/README_MOZILLAmedia/ffvpx/libavcodec/vp8.cmedia/ffvpx/vp8-reference-row-clamp.patch
Patch
diff --git a/media/ffvpx/README_MOZILLA b/media/ffvpx/README_MOZILLA
index 0cd085aeb01..691a8da8aa6 100644
--- a/media/ffvpx/README_MOZILLA
+++ b/media/ffvpx/README_MOZILLA
@@ -165,3 +165,6 @@ Finally, apply the patches:
- vp9-flush-unref-next-refs.patch to clear VP9 frame-thread references on
flush. Cherry-pick of FFmpeg commit a024f8c5413d, which is not in the 9.0
release branch; drop this patch once ffvpx is updated past it.
+- vp8-reference-row-clamp.patch to clamp the VP8 reference row await.
+ Cherry-pick of FFmpeg commit b772f5033c72, which is not in the 9.0 release
+ branch; drop this patch once ffvpx is updated past it.
diff --git a/media/ffvpx/libavcodec/vp8.c b/media/ffvpx/libavcodec/vp8.c
index 9010e19e6b7..0395933dfea 100644
--- a/media/ffvpx/libavcodec/vp8.c
+++ b/media/ffvpx/libavcodec/vp8.c
@@ -1843,7 +1843,7 @@ void vp8_mc_luma(VP8Context *s, VP8ThreadData *td, uint8_t *dst,
y_off += mv->y >> 2;
// edge emulation
- ff_progress_frame_await(ref, (3 + y_off + block_h + subpel_idx[2][my]) >> 4);
+ ff_progress_frame_await(ref, FFMAX((3 + y_off + block_h + subpel_idx[2][my]) >> 4, 0));
src += y_off * linesize + x_off;
if (x_off < mx_idx || x_off >= width - block_w - subpel_idx[2][mx] ||
y_off < my_idx || y_off >= height - block_h - subpel_idx[2][my]) {
@@ -1901,7 +1901,7 @@ void vp8_mc_chroma(VP8Context *s, VP8ThreadData *td, uint8_t *dst1,
// edge emulation
src1 += y_off * linesize + x_off;
src2 += y_off * linesize + x_off;
- ff_progress_frame_await(ref, (3 + y_off + block_h + subpel_idx[2][my]) >> 3);
+ ff_progress_frame_await(ref, FFMAX((3 + y_off + block_h + subpel_idx[2][my]) >> 3, 0));
if (x_off < mx_idx || x_off >= width - block_w - subpel_idx[2][mx] ||
y_off < my_idx || y_off >= height - block_h - subpel_idx[2][my]) {
s->vdsp.emulated_edge_mc(td->edge_emu_buffer,
diff --git a/media/ffvpx/vp8-reference-row-clamp.patch b/media/ffvpx/vp8-reference-row-clamp.patch
new file mode 100644
index 00000000000..2e819588778
--- /dev/null
+++ b/media/ffvpx/vp8-reference-row-clamp.patch
@@ -0,0 +1,21 @@
+diff --git a/media/ffvpx/libavcodec/vp8.c b/media/ffvpx/libavcodec/vp8.c
+--- a/media/ffvpx/libavcodec/vp8.c
++++ b/media/ffvpx/libavcodec/vp8.c
+@@ -1843,7 +1843,7 @@ void vp8_mc_luma(VP8Context *s, VP8ThreadData *td, uint8_t *dst,
+ y_off += mv->y >> 2;
+
+ // edge emulation
+- ff_progress_frame_await(ref, (3 + y_off + block_h + subpel_idx[2][my]) >> 4);
++ ff_progress_frame_await(ref, FFMAX((3 + y_off + block_h + subpel_idx[2][my]) >> 4, 0));
+ src += y_off * linesize + x_off;
+ if (x_off < mx_idx || x_off >= width - block_w - subpel_idx[2][mx] ||
+ y_off < my_idx || y_off >= height - block_h - subpel_idx[2][my]) {
+@@ -1901,7 +1901,7 @@ void vp8_mc_chroma(VP8Context *s, VP8ThreadData *td, uint8_t *dst1,
+ // edge emulation
+ src1 += y_off * linesize + x_off;
+ src2 += y_off * linesize + x_off;
+- ff_progress_frame_await(ref, (3 + y_off + block_h + subpel_idx[2][my]) >> 3);
++ ff_progress_frame_await(ref, FFMAX((3 + y_off + block_h + subpel_idx[2][my]) >> 3, 0));
+ if (x_off < mx_idx || x_off >= width - block_w - subpel_idx[2][mx] ||
+ y_off < my_idx || y_off >= height - block_h - subpel_idx[2][my]) {
+ s->vdsp.emulated_edge_mc(td->edge_emu_buffer,
Loading diff…
References
On This Page