Firefox · DOM
CVE-2026-4714
Logic Error in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/media/ipc/RemoteImageHolder.cpp
Patch
diff --git a/dom/media/ipc/RemoteImageHolder.cpp b/dom/media/ipc/RemoteImageHolder.cpp
index 083fd92955e..4cc53858d53 100644
--- a/dom/media/ipc/RemoteImageHolder.cpp
+++ b/dom/media/ipc/RemoteImageHolder.cpp
@@ -93,6 +93,13 @@ already_AddRefed<Image> RemoteImageHolder::DeserializeImage(
return nullptr;
}
+ auto croppedCbCr = ImageDataSerializer::GetCroppedCbCrSize(descriptor);
+ if (croppedCbCr.width > descriptor.cbCrSize().width ||
+ croppedCbCr.height > descriptor.cbCrSize().height) {
+ MOZ_ASSERT_UNREACHABLE("YCbCr chroma dimensions exceed CbCr plane size!");
+ return nullptr;
+ }
+
PlanarYCbCrData pData;
pData.mYStride = descriptor.yStride();
pData.mCbCrStride = descriptor.cbCrStride();
Loading diff…
References
On This Page