Firefox · DOM
CVE-2026-2773
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/media/webaudio/MediaBufferDecoder.cpp |
modified |
Files Changed
dom/media/webaudio/MediaBufferDecoder.cpp
Patch
diff --git a/dom/media/webaudio/MediaBufferDecoder.cpp b/dom/media/webaudio/MediaBufferDecoder.cpp
index 0c8ead37723..2e5de55873c 100644
--- a/dom/media/webaudio/MediaBufferDecoder.cpp
+++ b/dom/media/webaudio/MediaBufferDecoder.cpp
@@ -229,7 +229,12 @@ class AutoResampler final {
MOZ_ASSERT(mResampler);
return mResampler;
}
- void operator=(SpeexResamplerState* aResampler) { mResampler = aResampler; }
+ void operator=(SpeexResamplerState* aResampler) {
+ if (mResampler) {
+ speex_resampler_destroy(mResampler);
+ }
+ mResampler = aResampler;
+ }
private:
SpeexResamplerState* mResampler;
@@ -564,6 +569,14 @@ void MediaDecodeTask::FinishDecode() {
}
mDecodeJob.mBuffer.mBuffer = std::move(newBuffers);
channelCount = audioData->mChannels;
+
+ // Don't bother draining the previous resampler for unexpected edge case.
+ if (sampleRate != destSampleRate) {
+ resampler =
+ speex_resampler_init(channelCount, sampleRate, destSampleRate,
+ SPEEX_RESAMPLER_QUALITY_DEFAULT, nullptr);
+ speex_resampler_skip_zeros(resampler);
+ }
}
const AudioDataValue* bufferData =
Loading diff…
References
On This Page