Firefox · Graphics
CVE-2026-4706
Logic Error in Graphics
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifgfx/2d/FilterNodeSoftware.cpp |
modified | |
switchgfx/2d/FilterNodeSoftware.cpp |
modified |
Files Changed
gfx/2d/FilterNodeSoftware.cppgfx/2d/Filters.h
Patch
diff --git a/gfx/2d/FilterNodeSoftware.cpp b/gfx/2d/FilterNodeSoftware.cpp
index ec6c3672617..f16dc05f6e2 100644
--- a/gfx/2d/FilterNodeSoftware.cpp
+++ b/gfx/2d/FilterNodeSoftware.cpp
@@ -2591,6 +2591,11 @@ void FilterNodeDisplacementMapSoftware::SetAttribute(uint32_t aIndex,
void FilterNodeDisplacementMapSoftware::SetAttribute(uint32_t aIndex,
uint32_t aValue) {
+ // Refuse channel values that exceed channel maximum.
+ if (aValue > ColorChannel::COLOR_CHANNEL_MAX) {
+ return;
+ }
+
switch (aIndex) {
case ATT_DISPLACEMENT_MAP_X_CHANNEL:
mChannelX = static_cast<ColorChannel>(aValue);
@@ -2637,7 +2642,7 @@ already_AddRefed<DataSourceSurface> FilterNodeDisplacementMapSoftware::Render(
uint8_t* targetData = targetMap.GetData();
int32_t targetStride = targetMap.GetStride();
- static const ptrdiff_t channelMap[4] = {
+ static const ptrdiff_t channelMap[COLOR_CHANNEL_MAX + 1] = {
B8G8R8A8_COMPONENT_BYTEOFFSET_R, B8G8R8A8_COMPONENT_BYTEOFFSET_G,
B8G8R8A8_COMPONENT_BYTEOFFSET_B, B8G8R8A8_COMPONENT_BYTEOFFSET_A};
uint16_t xChannel = channelMap[mChannelX];
diff --git a/gfx/2d/Filters.h b/gfx/2d/Filters.h
index e9d31ce52e2..0a7b4908a05 100644
--- a/gfx/2d/Filters.h
+++ b/gfx/2d/Filters.h
@@ -192,7 +192,8 @@ enum ColorChannel {
COLOR_CHANNEL_R = 0,
COLOR_CHANNEL_G,
COLOR_CHANNEL_B,
- COLOR_CHANNEL_A
+ COLOR_CHANNEL_A,
+ COLOR_CHANNEL_MAX = COLOR_CHANNEL_A
};
enum DisplacementMapInputs {
Loading diff…
References
On This Page