Firefox · Graphics
CVE-2026-4707
Logic Error in Graphics
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
gfx/2d/FilterNodeSoftware.cpp
Patch
diff --git a/gfx/2d/FilterNodeSoftware.cpp b/gfx/2d/FilterNodeSoftware.cpp
index 1d4a61cf49a..f58f4521ecc 100644
--- a/gfx/2d/FilterNodeSoftware.cpp
+++ b/gfx/2d/FilterNodeSoftware.cpp
@@ -2439,9 +2439,11 @@ template <typename CoordType>
already_AddRefed<DataSourceSurface> FilterNodeConvolveMatrixSoftware::DoRender(
const IntRect& aRect, CoordType aKernelUnitLengthX,
CoordType aKernelUnitLengthY) {
+ // Ensure multiply fits in an int32_t so convolve math won't overflow.
+ auto kernelArea = CheckedInt32(mKernelSize.width) * mKernelSize.height;
if (mKernelSize.width <= 0 || mKernelSize.height <= 0 ||
- mKernelMatrix.size() !=
- uint32_t(mKernelSize.width * mKernelSize.height) ||
+ !kernelArea.isValid() ||
+ mKernelMatrix.size() != size_t(kernelArea.value()) ||
!IntRect(IntPoint(0, 0), mKernelSize).Contains(mTarget) ||
mDivisor == 0) {
return Factory::CreateDataSourceSurface(aRect.Size(),
Loading diff…
References
On This Page