Medium firefox Uninitialized Memory 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionUninitialized memory in the Graphics: Canvas2D component
ComponentGraphics
Bug ClassUninitialized Memory
Tracker2018405
Fix commit4bc9c2f9b62e (firefox) +45/-59
CISA KEVNot listed
CreditedJun Yang
Disclosed2026-03-24

Changed Functions

FunctionChangeNotes
if
gfx/2d/FilterNodeSoftware.cpp
modified
for
gfx/2d/FilterNodeSoftware.cpp
modified
switch
gfx/2d/FilterNodeSoftware.cpp
modified

Files Changed

  • gfx/2d/FilterNodeSoftware.cpp
  • gfx/2d/FilterNodeSoftware.h
diff --git a/gfx/2d/FilterNodeSoftware.cpp b/gfx/2d/FilterNodeSoftware.cpp
index 1b66cf50a3f..ec6c3672617 100644
--- a/gfx/2d/FilterNodeSoftware.cpp
+++ b/gfx/2d/FilterNodeSoftware.cpp
@@ -1765,12 +1765,10 @@ void FilterNodeComponentTransferSoftware::SetAttribute(uint32_t aIndex,
 
 void FilterNodeComponentTransferSoftware::GenerateLookupTable(
     ptrdiff_t aComponent, uint8_t aTables[4][256], bool aDisabled) {
-  if (aDisabled) {
+  if (aDisabled || !FillLookupTable(aComponent, aTables[aComponent])) {
     for (int32_t i = 0; i < 256; ++i) {
       aTables[aComponent][i] = i;
     }
-  } else {
-    FillLookupTable(aComponent, aTables[aComponent]);
   }
 }
 
@@ -1927,32 +1925,28 @@ void FilterNodeTableTransferSoftware::SetAttribute(uint32_t aIndex,
   Invalidate();
 }
 
-void FilterNodeTableTransferSoftware::FillLookupTable(ptrdiff_t aComponent,
+bool FilterNodeTableTransferSoftware::FillLookupTable(ptrdiff_t aComponent,
                                                       uint8_t aTable[256]) {
   switch (aComponent) {
     case B8G8R8A8_COMPONENT_BYTEOFFSET_R:
-      FillLookupTableImpl(mTableR, aTable);
-      break;
+      return FillLookupTableImpl(mTableR, aTable);
     case B8G8R8A8_COMPONENT_BYTEOFFSET_G:
-      FillLookupTableImpl(mTableG, aTable);
-      break;
+      return FillLookupTableImpl(mTableG, aTable);
     case B8G8R8A8_COMPONENT_BYTEOFFSET_B:
-      FillLookupTableImpl(mTableB, aTable);
-      break;
+      return FillLookupTableImpl(mTableB, aTable);
     case B8G8R8A8_COMPONENT_BYTEOFFSET_A:
-      FillLookupTableImpl(mTableA, aTable);
-      break;
+      return FillLookupTableImpl(mTableA, aTable);
     default:
       MOZ_ASSERT(false, "unknown component");
-      break;
+      return false;
   }
 }
 
-void FilterNodeTableTransferSoftware::FillLookupTableImpl(
+bool FilterNodeTableTransferSoftware::FillLookupTableImpl(
     const std::vector<Float>& aTableValues, uint8_t aTable[256]) {
   uint32_t tvLength = aTableValues.size();
-  if (tvLength < 2) {
-    return;
+  if (tvLength < 1) {
+    return false;
   }
 
   for (size_t i = 0; i < 256; i++) {
@@ -1963,6 +1957,7 @@ void FilterNodeTableTransferSoftware::FillLookupTableImpl(
                                           (tvLength - 1) * (v2 - v1)));
     aTable[i] = std::clamp(val, 0, 255);
   }
+  return true;
 }
 
 void FilterNodeDiscreteTransferSoftware::SetAttribute(uint32_t aIndex,
@@ -1988,32 +1983,28 @@ void FilterNodeDiscreteTransferSoftware::SetAttribute(uint32_t aIndex,
   Invalidate();
 }
 
-void FilterNodeDiscreteTransferSoftware::FillLookupTable(ptrdiff_t aComponent,
+bool FilterNodeDiscreteTransferSoftware::FillLookupTable(ptrdiff_t aComponent,
                                                          uint8_t aTable[256]) {
   switch (aComponent) {
     case B8G8R8A8_COMPONENT_BYTEOFFSET_R:
-      FillLookupTableImpl(mTableR, aTable);
-      break;
+      return FillLookupTableImpl(mTableR, aTable);
     case B8G8R8A8_COMPONENT_BYTEOFFSET_G:
-      FillLookupTableImpl(mTableG, aTable);
-      break;
+      return FillLookupTableImpl(mTableG, aTable);
     case B8G8R8A8_COMPONENT_BYTEOFFSET_B:
-      FillLookupTableImpl(mTableB, aTable);
-      break;
+      return FillLookupTableImpl(mTableB, aTable);
     case B8G8R8A8_COMPONENT_BYTEOFFSET_A:
-      FillLookupTableImpl(mTableA, aTable);
-      break;
+      return FillLookupTableImpl(mTableA, aTable);
     default:
       MOZ_ASSERT(false, "unknown component");
-      break;
+      return false;
   }
 }
 
-void FilterNodeDiscreteTransferSoftware::FillLookupTableImpl(
+bool FilterNodeDiscreteTransferSoftware::FillLookupTableImpl(
     const std::vector<Float>& aTableValues, uint8_t aTable[256]) {
   uint32_t tvLength = aTableValues.size();
   if (tvLength < 1) {
-    return;
+    return false;
   }
 
   for (size_t i = 0; i < 256; i++) {
@@ -2023,6 +2014,7 @@ void FilterNodeDiscreteTransferSoftware::FillLookupTableImpl(
     int32_t val = NS_lround(255 * v);
     aTable[i] = std::clamp(val, 0, 255);
   }
+  return true;
 }
 
 FilterNodeLinearTransferSoftware::FilterNodeLinearTransferSoftware()
@@ -2068,33 +2060,30 @@ void FilterNodeLinearTransferSoftware::SetAttribute(uint32_t aIndex,
   Invalidate();
 }
 
-void FilterNodeLinearTransferSoftware::FillLookupTable(ptrdiff_t aComponent,
+bool FilterNodeLinearTransferSoftware::FillLookupTable(ptrdiff_t aComponent,
                                                        uint8_t aTable[256]) {
   switch (aComponent) {
     case B8G8R8A8_COMPONENT_BYTEOFFSET_R:
-      FillLookupTableImpl(mSlopeR, mInterceptR, aTable);
-      break;
+      return FillLookupTableImpl(mSlopeR, mInterceptR, aTable);
     case B8G8R8A8_COMPONENT_BYTEOFFSET_G:
-      FillLookupTableImpl(mSlopeG, mInterceptG, aTable);
-      break;
+      return FillLookupTableImpl(mSlopeG, mInterceptG, aTable);
     case B8G8R8A8_COMPONENT_BYTEOFFSET_B:
-      FillLookupTableImpl(mSlopeB, mInterceptB, aTable);
-      break;
+      return FillLookupTableImpl(mSlopeB, mInterceptB, aTable);
     case B8G8R8A8_COMPONENT_BYTEOFFSET_A:
-      FillLookupTableImpl(mSlopeA, mInterceptA, aTable);
-      break;
+      return FillLookupTableImpl(mSlopeA, mInterceptA, aTable);
     default:
       MOZ_ASSERT(false, "unknown component");
-      break;
+      return false;
   }
 }
 
-void FilterNodeLinearTransferSoftware::FillLookupTableImpl(
+bool FilterNodeLinearTransferSoftware::FillLookupTableImpl(
     Float aSlope, Float aIntercept, uint8_t aTable[256]) {
   for (size_t i = 0; i < 256; i++) {
     int32_t val = NS_lround(aSlope * i + 255 * aIntercept);
     aTable[i] = std::clamp(val, 0, 255);
   }
+  return true;
 }
 
 FilterNodeGammaTransferSoftware::FilterNodeGammaTransferSoftware()
@@ -2156,28 +2145,24 @@ void FilterNodeGammaTransferSoftware::SetAttribute(uint32_t aIndex,
   Invalidate();
 }
 
-void FilterNodeGammaTransferSoftware::FillLookupTable(ptrdiff_t aComponent,
+bool FilterNodeGammaTransferSoftware::FillLookupTable(ptrdiff_t aComponent,
                                                       uint8_t aTable[256]) {
   switch (aComponent) {
     case B8G8R8A8_COMPONENT_BYTEOFFSET_R:
-      FillLookupTableImpl(mAmplitudeR, mExponentR, mOffsetR, aTable);
-      break;
+      return FillLookupTableImpl(mAmplitudeR, mExponentR, mOffsetR, aTable);
     case B8G8R8A8_COMPONENT_BYTEOFFSET_G:
-      FillLookupTableImpl(mAmplitudeG, mExponentG, mOffsetG, aTable);
-      break;
+      return FillLookupTableImpl(mAmplitudeG, mExponentG, mOffsetG, aTable);
     case B8G8R8A8_COMPONENT_BYTEOFFSET_B:
-      FillLookupTableImpl(mAmplitudeB, mExponentB, mOffsetB, aTable);
-      break;
+      return FillLookupTableImpl(mAmplitudeB, mExponentB, mOffsetB, aTable);
     case B8G8R8A8_COMPONENT_BYTEOFFSET_A:
-      FillLookupTableImpl(mAmplitudeA, mExponentA, mOffsetA, aTable);
-      break;
+      return FillLookupTableImpl(mAmplitudeA, mExponentA, mOffsetA, aTable);
     default:
       MOZ_ASSERT(false, "unknown component");
-      break;
+      return false;
   }
 }
 
-void FilterNodeGammaTransferSoftware::FillLookupTableImpl(Float aAmplitude,
+bool FilterNodeGammaTransferSoftware::FillLookupTableImpl(Float aAmplitude,
                                                           Float aExponent,
                                                           Float aOffset,
                                                           uint8_t aTable[256]) {
@@ -2186,6 +2171,7 @@ void FilterNodeGammaTransferSoftware::FillLookupTableImpl(Float aAmplitude,
         NS_lround(255 * (aAmplitude * pow(i / 255.0f, aExponent) + aOffset));
     aTable[i] = std::clamp(val, 0, 255);
   }
+  return true;
Loading diff…