Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionRace condition, use-after-free in the Graphics: Text component
ComponentGraphics
Bug ClassLogic Error
Tracker2073396
Fix commit32f24ec90930 (firefox) +18/-14
CISA KEVNot listed
CreditedShu Takahashi of Velcore Consulting Inc.
Disclosed2026-10-13

Changed Functions

FunctionChangeNotes
if
gfx/thebes/gfxFontEntry.cpp
modified
if
gfx/thebes/gfxMacFont.cpp
modified

Files Changed

  • gfx/thebes/gfxFontEntry.cpp
  • gfx/thebes/gfxMacFont.cpp
diff --git a/gfx/thebes/gfxFontEntry.cpp b/gfx/thebes/gfxFontEntry.cpp
index 0569721377c..c3b7212671f 100644
--- a/gfx/thebes/gfxFontEntry.cpp
+++ b/gfx/thebes/gfxFontEntry.cpp
@@ -1237,7 +1237,6 @@ void gfxFontEntry::CheckForVariationAxes() {
   if (mCheckedForVariationAxes) {
     return;
   }
-  mCheckedForVariationAxes = true;
   if (HasVariations()) {
     AutoTArray<gfxFontVariationAxis, 4> axes;
     GetVariationAxes(axes);
@@ -1254,6 +1253,7 @@ void gfxFontEntry::CheckForVariationAxes() {
       }
     }
   }
+  mCheckedForVariationAxes = true;
 }
 
 bool gfxFontEntry::HasBoldVariableWeight() {
diff --git a/gfx/thebes/gfxMacFont.cpp b/gfx/thebes/gfxMacFont.cpp
index 06542c9bcb2..f56a58fcfc4 100644
--- a/gfx/thebes/gfxMacFont.cpp
+++ b/gfx/thebes/gfxMacFont.cpp
@@ -74,15 +74,18 @@ gfxMacFont::gfxMacFont(const RefPtr<UnscaledFontMac>& aUnscaledFont,
         auto index = axes.IndexOf(kOpszTag, 0, AxisTagEquals());
         MOZ_ASSERT(index != axes.NoIndex);
         if (index != axes.NoIndex) {
-          const auto& axis = axes[index];
-          aFontEntry->mOpszAxis = axis;
-          // Pick a slightly-adjusted version of the default that we'll
-          // use to work around Core Text's habit of ignoring any attempt
-          // to explicitly set the default value.
-          aFontEntry->mAdjustedDefaultOpsz =
-              axis.mDefaultValue == axis.mMinValue
-                  ? axis.mDefaultValue + kOpszFudgeAmount
-                  : axis.mDefaultValue - kOpszFudgeAmount;
+          AutoWriteLock lock(aFontEntry->mLock);
+          if (!aFontEntry->mOpszAxis.mTag) {
+            const auto& axis = axes[index];
+            // Pick a slightly-adjusted version of the default that we'll
+            // use to work around Core Text's habit of ignoring any attempt
+            // to explicitly set the default value.
+            aFontEntry->mAdjustedDefaultOpsz =
+                axis.mDefaultValue == axis.mMinValue
+                    ? axis.mDefaultValue + kOpszFudgeAmount
+                    : axis.mDefaultValue - kOpszFudgeAmount;
+            aFontEntry->mOpszAxis = axis;
+          }
         }
       }
 
@@ -107,13 +110,14 @@ gfxMacFont::gfxMacFont(const RefPtr<UnscaledFontMac>& aUnscaledFont,
 
     static_assert(
         sizeof(gfxFontVariation) == sizeof(wr::FontVariation) &&
-            offsetof(gfxFontVariation, tag) == offsetof(wr::FontVariation, tag) &&
-            offsetof(gfxFontVariation, value) ==
-                offsetof(FontVariation, value),
+            offsetof(gfxFontVariation, tag) ==
+                offsetof(wr::FontVariation, tag) &&
+            offsetof(gfxFontVariation, value) == offsetof(FontVariation, value),
         "gfxFontVariation vs Moz2D FontVariation struct mismatch!");
     mCGFont = UnscaledFontMac::CreateCGFontWithVariations(
         baseFont, aUnscaledFont->CGAxesCache(), aUnscaledFont->CTAxesCache(),
-        vars.Length(), reinterpret_cast<const wr::FontVariation*>(vars.Elements()));
+        vars.Length(),
+        reinterpret_cast<const wr::FontVariation*>(vars.Elements()));
     if (!mCGFont) {
       ::CFRetain(baseFont);
       mCGFont = baseFont;
Loading diff…