Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionUse-after-free in the Audio/Video: Playback component
ComponentMedia
Bug ClassLogic Error
Tracker2047722
Fix commit03045c9fbf60 (firefox) +26/-2
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-13

Files Changed

  • media/ffvpx/README_MOZILLA
  • media/ffvpx/libavcodec/vp8.c
  • media/ffvpx/vp8-reference-row-clamp.patch
diff --git a/media/ffvpx/README_MOZILLA b/media/ffvpx/README_MOZILLA
index 0cd085aeb01..691a8da8aa6 100644
--- a/media/ffvpx/README_MOZILLA
+++ b/media/ffvpx/README_MOZILLA
@@ -165,3 +165,6 @@ Finally, apply the patches:
 - vp9-flush-unref-next-refs.patch to clear VP9 frame-thread references on
   flush. Cherry-pick of FFmpeg commit a024f8c5413d, which is not in the 9.0
   release branch; drop this patch once ffvpx is updated past it.
+- vp8-reference-row-clamp.patch to clamp the VP8 reference row await.
+  Cherry-pick of FFmpeg commit b772f5033c72, which is not in the 9.0 release
+  branch; drop this patch once ffvpx is updated past it.
diff --git a/media/ffvpx/libavcodec/vp8.c b/media/ffvpx/libavcodec/vp8.c
index 9010e19e6b7..0395933dfea 100644
--- a/media/ffvpx/libavcodec/vp8.c
+++ b/media/ffvpx/libavcodec/vp8.c
@@ -1843,7 +1843,7 @@ void vp8_mc_luma(VP8Context *s, VP8ThreadData *td, uint8_t *dst,
         y_off += mv->y >> 2;
 
         // edge emulation
-        ff_progress_frame_await(ref, (3 + y_off + block_h + subpel_idx[2][my]) >> 4);
+        ff_progress_frame_await(ref, FFMAX((3 + y_off + block_h + subpel_idx[2][my]) >> 4, 0));
         src += y_off * linesize + x_off;
         if (x_off < mx_idx || x_off >= width  - block_w - subpel_idx[2][mx] ||
             y_off < my_idx || y_off >= height - block_h - subpel_idx[2][my]) {
@@ -1901,7 +1901,7 @@ void vp8_mc_chroma(VP8Context *s, VP8ThreadData *td, uint8_t *dst1,
         // edge emulation
         src1 += y_off * linesize + x_off;
         src2 += y_off * linesize + x_off;
-        ff_progress_frame_await(ref, (3 + y_off + block_h + subpel_idx[2][my]) >> 3);
+        ff_progress_frame_await(ref, FFMAX((3 + y_off + block_h + subpel_idx[2][my]) >> 3, 0));
         if (x_off < mx_idx || x_off >= width  - block_w - subpel_idx[2][mx] ||
             y_off < my_idx || y_off >= height - block_h - subpel_idx[2][my]) {
             s->vdsp.emulated_edge_mc(td->edge_emu_buffer,
diff --git a/media/ffvpx/vp8-reference-row-clamp.patch b/media/ffvpx/vp8-reference-row-clamp.patch
new file mode 100644
index 00000000000..2e819588778
--- /dev/null
+++ b/media/ffvpx/vp8-reference-row-clamp.patch
@@ -0,0 +1,21 @@
+diff --git a/media/ffvpx/libavcodec/vp8.c b/media/ffvpx/libavcodec/vp8.c
+--- a/media/ffvpx/libavcodec/vp8.c
++++ b/media/ffvpx/libavcodec/vp8.c
+@@ -1843,7 +1843,7 @@ void vp8_mc_luma(VP8Context *s, VP8ThreadData *td, uint8_t *dst,
+         y_off += mv->y >> 2;
+
+         // edge emulation
+-        ff_progress_frame_await(ref, (3 + y_off + block_h + subpel_idx[2][my]) >> 4);
++        ff_progress_frame_await(ref, FFMAX((3 + y_off + block_h + subpel_idx[2][my]) >> 4, 0));
+         src += y_off * linesize + x_off;
+         if (x_off < mx_idx || x_off >= width  - block_w - subpel_idx[2][mx] ||
+             y_off < my_idx || y_off >= height - block_h - subpel_idx[2][my]) {
+@@ -1901,7 +1901,7 @@ void vp8_mc_chroma(VP8Context *s, VP8ThreadData *td, uint8_t *dst1,
+         // edge emulation
+         src1 += y_off * linesize + x_off;
+         src2 += y_off * linesize + x_off;
+-        ff_progress_frame_await(ref, (3 + y_off + block_h + subpel_idx[2][my]) >> 3);
++        ff_progress_frame_await(ref, FFMAX((3 + y_off + block_h + subpel_idx[2][my]) >> 3, 0));
+         if (x_off < mx_idx || x_off >= width  - block_w - subpel_idx[2][mx] ||
+             y_off < my_idx || y_off >= height - block_h - subpel_idx[2][my]) {
+             s->vdsp.emulated_edge_mc(td->edge_emu_buffer,
Loading diff…