Firefox · Graphics
CVE-2026-12328
Memory Corruption in Graphics
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
GLFragColorBroadcastTraversergfx/angle/checkout/src/compiler/translator/tree_ops/EmulateGLFragColorBroadcast.cpp |
modified |
Files Changed
gfx/angle/checkout/src/compiler/translator/tree_ops/EmulateGLFragColorBroadcast.cpp
Patch
diff --git a/gfx/angle/checkout/src/compiler/translator/tree_ops/EmulateGLFragColorBroadcast.cpp b/gfx/angle/checkout/src/compiler/translator/tree_ops/EmulateGLFragColorBroadcast.cpp
index 25e1fde29a2..606a94ff9b9 100644
--- a/gfx/angle/checkout/src/compiler/translator/tree_ops/EmulateGLFragColorBroadcast.cpp
+++ b/gfx/angle/checkout/src/compiler/translator/tree_ops/EmulateGLFragColorBroadcast.cpp
@@ -26,6 +26,7 @@ namespace
{
constexpr const ImmutableString kGlFragDataString("gl_FragData");
+constexpr const ImmutableString kGlSecondaryFragDataString("gl_SecondaryFragDataEXT");
class GLFragColorBroadcastTraverser : public TIntermTraverser
{
@@ -42,6 +43,8 @@ class GLFragColorBroadcastTraverser : public TIntermTraverser
bool isGLFragColorUsed() const { return mGLFragColorUsed; }
protected:
+ bool visitGlobalQualifierDeclaration(Visit visit,
+ TIntermGlobalQualifierDeclaration *node) override;
void visitSymbol(TIntermSymbol *node) override;
TIntermBinary *constructGLFragDataNode(int index) const;
@@ -71,6 +74,31 @@ TIntermBinary *GLFragColorBroadcastTraverser::constructGLFragDataAssignNode(int
return new TIntermBinary(EOpAssign, fragDataIndex, fragDataZero);
}
+bool GLFragColorBroadcastTraverser::visitGlobalQualifierDeclaration(
+ Visit visit,
+ TIntermGlobalQualifierDeclaration *node)
+{
+ TIntermSymbol *symbol = node->getSymbol();
+ if (symbol->variable().symbolType() == SymbolType::BuiltIn)
+ {
+ if (symbol->getName() == "gl_FragColor")
+ {
+ queueReplacementWithParent(
+ node, node->getSymbol(),
+ ReferenceBuiltInVariable(kGlFragDataString, *mSymbolTable, mShaderVersion),
+ OriginalNode::IS_DROPPED);
+ }
+ else if (symbol->getName() == "gl_SecondaryFragColorEXT")
+ {
+ queueReplacementWithParent(
+ node, node->getSymbol(),
+ ReferenceBuiltInVariable(kGlSecondaryFragDataString, *mSymbolTable, mShaderVersion),
+ OriginalNode::IS_DROPPED);
+ }
+ }
+ return false;
+}
+
void GLFragColorBroadcastTraverser::visitSymbol(TIntermSymbol *node)
{
if (node->variable().symbolType() == SymbolType::BuiltIn && node->getName() == "gl_FragColor")
Loading diff…
References
On This Page