Medium firefox UAF 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionSandbox escape due to use-after-free in the Graphics: Canvas2D component
ComponentGraphics
Bug ClassUAF
Tracker2017108
Fix commit0637f0643d8f (firefox) +8/-11
CISA KEVNot listed
CreditedJun Yang
Disclosed2026-03-24

Changed Functions

FunctionChangeNotes
if
gfx/layers/ipc/CanvasTranslator.cpp
modified

Files Changed

  • gfx/layers/ipc/CanvasTranslator.cpp
diff --git a/gfx/layers/ipc/CanvasTranslator.cpp b/gfx/layers/ipc/CanvasTranslator.cpp
index a8706981a1b..472774ad5af 100644
--- a/gfx/layers/ipc/CanvasTranslator.cpp
+++ b/gfx/layers/ipc/CanvasTranslator.cpp
@@ -416,17 +416,14 @@ bool CanvasTranslator::SetDataSurfaceBuffer(
   DataSurfaceBufferWillChange(aId);
 
   // Finally, change the shmem mapping.
-  {
-    auto& dataSurfaceShmem = mDataSurfaceShmems[aId];
-    dataSurfaceShmem.mShmem = aBufferHandle.Map();
-    if (!dataSurfaceShmem.mShmem) {
-      // Try clearing out old mappings to see if resource limits were reached.
-      DataSurfaceBufferWillChange(0, false);
-      // Try mapping one last time.
-      dataSurfaceShmem.mShmem = aBufferHandle.Map();
-      if (!dataSurfaceShmem.mShmem) {
-        return false;
-      }
+  mDataSurfaceShmems[aId].mShmem = aBufferHandle.Map();
+  if (!mDataSurfaceShmems[aId].mShmem) {
+    // Try clearing out old mappings to see if resource limits were reached.
+    DataSurfaceBufferWillChange(0, false);
+    // Try mapping one last time.
+    mDataSurfaceShmems[aId].mShmem = aBufferHandle.Map();
+    if (!mDataSurfaceShmems[aId].mShmem) {
+      return false;
     }
   }
 
Loading diff…