Firefox · Graphics
CVE-2026-109765
Logic Error in Graphics
Overview
Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifgfx/thebes/gfxFontEntry.cpp |
modified | |
ifgfx/thebes/gfxMacFont.cpp |
modified |
Files Changed
gfx/thebes/gfxFontEntry.cppgfx/thebes/gfxMacFont.cpp
Patch
diff --git a/gfx/thebes/gfxFontEntry.cpp b/gfx/thebes/gfxFontEntry.cpp
index 0569721377c..c3b7212671f 100644
--- a/gfx/thebes/gfxFontEntry.cpp
+++ b/gfx/thebes/gfxFontEntry.cpp
@@ -1237,7 +1237,6 @@ void gfxFontEntry::CheckForVariationAxes() {
if (mCheckedForVariationAxes) {
return;
}
- mCheckedForVariationAxes = true;
if (HasVariations()) {
AutoTArray<gfxFontVariationAxis, 4> axes;
GetVariationAxes(axes);
@@ -1254,6 +1253,7 @@ void gfxFontEntry::CheckForVariationAxes() {
}
}
}
+ mCheckedForVariationAxes = true;
}
bool gfxFontEntry::HasBoldVariableWeight() {
diff --git a/gfx/thebes/gfxMacFont.cpp b/gfx/thebes/gfxMacFont.cpp
index 06542c9bcb2..f56a58fcfc4 100644
--- a/gfx/thebes/gfxMacFont.cpp
+++ b/gfx/thebes/gfxMacFont.cpp
@@ -74,15 +74,18 @@ gfxMacFont::gfxMacFont(const RefPtr<UnscaledFontMac>& aUnscaledFont,
auto index = axes.IndexOf(kOpszTag, 0, AxisTagEquals());
MOZ_ASSERT(index != axes.NoIndex);
if (index != axes.NoIndex) {
- const auto& axis = axes[index];
- aFontEntry->mOpszAxis = axis;
- // Pick a slightly-adjusted version of the default that we'll
- // use to work around Core Text's habit of ignoring any attempt
- // to explicitly set the default value.
- aFontEntry->mAdjustedDefaultOpsz =
- axis.mDefaultValue == axis.mMinValue
- ? axis.mDefaultValue + kOpszFudgeAmount
- : axis.mDefaultValue - kOpszFudgeAmount;
+ AutoWriteLock lock(aFontEntry->mLock);
+ if (!aFontEntry->mOpszAxis.mTag) {
+ const auto& axis = axes[index];
+ // Pick a slightly-adjusted version of the default that we'll
+ // use to work around Core Text's habit of ignoring any attempt
+ // to explicitly set the default value.
+ aFontEntry->mAdjustedDefaultOpsz =
+ axis.mDefaultValue == axis.mMinValue
+ ? axis.mDefaultValue + kOpszFudgeAmount
+ : axis.mDefaultValue - kOpszFudgeAmount;
+ aFontEntry->mOpszAxis = axis;
+ }
}
}
@@ -107,13 +110,14 @@ gfxMacFont::gfxMacFont(const RefPtr<UnscaledFontMac>& aUnscaledFont,
static_assert(
sizeof(gfxFontVariation) == sizeof(wr::FontVariation) &&
- offsetof(gfxFontVariation, tag) == offsetof(wr::FontVariation, tag) &&
- offsetof(gfxFontVariation, value) ==
- offsetof(FontVariation, value),
+ offsetof(gfxFontVariation, tag) ==
+ offsetof(wr::FontVariation, tag) &&
+ offsetof(gfxFontVariation, value) == offsetof(FontVariation, value),
"gfxFontVariation vs Moz2D FontVariation struct mismatch!");
mCGFont = UnscaledFontMac::CreateCGFontWithVariations(
baseFont, aUnscaledFont->CGAxesCache(), aUnscaledFont->CTAxesCache(),
- vars.Length(), reinterpret_cast<const wr::FontVariation*>(vars.Elements()));
+ vars.Length(),
+ reinterpret_cast<const wr::FontVariation*>(vars.Elements()));
if (!mCGFont) {
::CFRetain(baseFont);
mCGFont = baseFont;
Loading diff…
References
On This Page