Firefox · DOM
CVE-2026-12306
Logic Error in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/canvas/WebGL2ContextBuffers.cpp |
modified |
Files Changed
dom/canvas/WebGL2ContextBuffers.cpp
Patch
diff --git a/dom/canvas/WebGL2ContextBuffers.cpp b/dom/canvas/WebGL2ContextBuffers.cpp
index 5012c70ff3e..761a3ee3d0d 100644
--- a/dom/canvas/WebGL2ContextBuffers.cpp
+++ b/dom/canvas/WebGL2ContextBuffers.cpp
@@ -73,6 +73,22 @@ void WebGL2Context::CopyBufferSubData(GLenum readTarget, GLenum writeTarget,
gl->fCopyBufferSubData(readTarget, writeTarget, readOffset, writeOffset,
size);
+ // Update the destination index cache if needed.
+ if (writeBuffer->mIndexCache) {
+ MOZ_ASSERT(readBuffer->mIndexCache);
+ if (readBuffer->mIndexCache) {
+ // The read and write ranges have been validated above by fnValidateOffsetSize.
+ // If allocated, the size of mIndexCache is always mByteLength.
+ const auto* src =
+ static_cast<const uint8_t*>(readBuffer->mIndexCache.get()) +
+ readOffset;
+ auto* dst =
+ static_cast<uint8_t*>(writeBuffer->mIndexCache.get()) + writeOffset;
+ memcpy(dst, src, size);
+ }
+ writeBuffer->InvalidateCacheRange(writeOffset, size);
+ }
+
writeBuffer->ResetLastUpdateFenceId();
}
Loading diff…
References
On This Page