Firefox · DOM
CVE-2026-2793
Memory Corruption in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/canvas/TexUnpackBlob.cpp
Patch
diff --git a/dom/canvas/TexUnpackBlob.cpp b/dom/canvas/TexUnpackBlob.cpp
index ff8b8f751e8..104e4155bb3 100644
--- a/dom/canvas/TexUnpackBlob.cpp
+++ b/dom/canvas/TexUnpackBlob.cpp
@@ -1172,12 +1172,6 @@ bool TexUnpackSurface::TexOrSubImage(bool isSubImage, bool needsRespec,
////
- const IntSize surfSize = surf->GetSize();
- if (uint32_t(surfSize.width) < size.x || uint32_t(surfSize.height) < size.y) {
- gfxCriticalError() << "Source surface size too small for upload.";
- return false;
- }
-
WebGLTexelFormat srcFormat;
uint8_t srcBPP;
if (!GetFormatForSurf(surf, &srcFormat, &srcBPP)) {
@@ -1202,7 +1196,7 @@ bool TexUnpackSurface::TexOrSubImage(bool isSubImage, bool needsRespec,
const auto dstFormat = FormatForPackingInfo(dstPI);
const size_t dstBpp = BytesPerPixel(dstPI);
- const size_t dstUsedBytesPerRow = dstBpp * surfSize.width;
+ const size_t dstUsedBytesPerRow = dstBpp * surf->GetSize().width;
size_t dstStride = dstFormat == srcFormat ? srcStride // Try To match
: dstUsedBytesPerRow;
@@ -1233,7 +1227,7 @@ bool TexUnpackSurface::TexOrSubImage(bool isSubImage, bool needsRespec,
const uint8_t* dstBegin = srcBegin;
UniqueBuffer tempBuffer;
// clang-format off
- if (!ConvertIfNeeded(webgl, surfSize.width, surfSize.height,
+ if (!ConvertIfNeeded(webgl, surf->GetSize().width, surf->GetSize().height,
srcFormat, srcBegin, AutoAssertCast(srcStride),
dstFormat, AutoAssertCast(dstUnpacking.metrics.bytesPerRowStride), &dstBegin,
&tempBuffer)) {
Loading diff…
References
On This Page