Firefox · ImageLib
CVE-2026-2789
UAF in ImageLib
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifimage/SourceBuffer.cpp |
modified | |
ifimage/SourceBuffer.h |
modified |
Files Changed
image/SourceBuffer.cppimage/SourceBuffer.h
Patch
diff --git a/image/SourceBuffer.cpp b/image/SourceBuffer.cpp
index eaf5ba6beb9..5efe921eff4 100644
--- a/image/SourceBuffer.cpp
+++ b/image/SourceBuffer.cpp
@@ -206,7 +206,11 @@ nsresult SourceBuffer::Compact() {
if (capacity == MAX_CHUNK_CAPACITY) {
size_t lastLength = mChunks.LastElement().Length();
if (lastLength != capacity) {
- mChunks.LastElement().SetCapacity(lastLength);
+ if (lastLength == 0) {
+ mChunks.RemoveLastElement();
+ } else {
+ mChunks.LastElement().SetCapacity(lastLength);
+ }
}
return NS_OK;
}
@@ -446,6 +450,9 @@ nsresult SourceBuffer::AdoptData(char* aData, size_t aLength,
void (*aFree)(void*)) {
MOZ_ASSERT(aData, "Should have a buffer");
MOZ_ASSERT(aLength > 0, "Writing a zero-sized chunk");
+ if (!aData || aLength == 0) {
+ return NS_ERROR_INVALID_ARG;
+ }
MutexAutoLock lock(mMutex);
return AppendChunk(Some(Chunk(aData, aLength, aRealloc, aFree)));
}
diff --git a/image/SourceBuffer.h b/image/SourceBuffer.h
index 77311783d99..cec5145e9f9 100644
--- a/image/SourceBuffer.h
+++ b/image/SourceBuffer.h
@@ -406,7 +406,7 @@ class SourceBuffer final {
}
Chunk& operator=(Chunk&& aOther) {
- free(mData);
+ mFree(mData);
mCapacity = aOther.mCapacity;
mLength = aOther.mLength;
mData = aOther.mData;
@@ -431,6 +431,10 @@ class SourceBuffer final {
bool SetCapacity(size_t aCapacity) {
MOZ_ASSERT(mData, "Allocation failed but nobody checked for it");
+ MOZ_ASSERT(aCapacity > 0, "zero sized resize");
+ if (aCapacity == 0) {
+ return false;
+ }
char* data = static_cast<char*>(mRealloc(mData, aCapacity));
if (!data) {
return false;
Loading diff…
References
On This Page