Firefox · DOM
CVE-2026-6748
Uninitialized Memory in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
switchdom/media/webcodecs/VideoFrame.cpp |
modified |
Files Changed
dom/media/webcodecs/VideoFrame.cpp
Patch
diff --git a/dom/media/webcodecs/VideoFrame.cpp b/dom/media/webcodecs/VideoFrame.cpp
index 6bc463f84ac..13a51b9aa12 100644
--- a/dom/media/webcodecs/VideoFrame.cpp
+++ b/dom/media/webcodecs/VideoFrame.cpp
@@ -2823,11 +2823,11 @@ bool VideoFrame::Resource::CopyTo(const Format::Plane& aPlane,
return false;
}
- auto copyPlane = [&](const uint8_t* aPlaneData) {
+ auto copyPlane = [&](const uint8_t* aPlaneData, int32_t aSourceStride) {
MOZ_ASSERT(aPlaneData);
CheckedInt<size_t> offset(aRect.Y());
- offset *= Stride(aPlane);
+ offset *= aSourceStride;
offset += aRect.X() * mFormat->SampleBytes(aPlane);
if (!offset.isValid()) {
return false;
@@ -2842,9 +2842,9 @@ bool VideoFrame::Resource::CopyTo(const Format::Plane& aPlane,
aPlaneData += offset.value();
for (int32_t row = 0; row < aRect.Height(); ++row) {
PodCopy(aPlaneDest.data(), aPlaneData, elementsBytes.value());
- aPlaneData += Stride(aPlane);
+ aPlaneData += aSourceStride;
// Spec asks to move `aDestinationStride` bytes instead of
- // `Stride(aPlane)` forward.
+ // `aSourceStride` forward.
aPlaneDest = aPlaneDest.From(aDestinationStride);
}
return true;
@@ -2853,16 +2853,20 @@ bool VideoFrame::Resource::CopyTo(const Format::Plane& aPlane,
if (mImage->GetFormat() == ImageFormat::PLANAR_YCBCR) {
switch (aPlane) {
case Format::Plane::Y:
- return copyPlane(mImage->AsPlanarYCbCrImage()->GetData()->mYChannel);
+ return copyPlane(mImage->AsPlanarYCbCrImage()->GetData()->mYChannel,
+ Stride(aPlane));
case Format::Plane::U:
- return copyPlane(mImage->AsPlanarYCbCrImage()->GetData()->mCbChannel);
+ return copyPlane(mImage->AsPlanarYCbCrImage()->GetData()->mCbChannel,
+ Stride(aPlane));
case Format::Plane::V:
- return copyPlane(mImage->AsPlanarYCbCrImage()->GetData()->mCrChannel);
+ return copyPlane(mImage->AsPlanarYCbCrImage()->GetData()->mCrChannel,
+ Stride(aPlane));
case Format::Plane::A:
MOZ_ASSERT(mFormat->PixelFormat() == VideoPixelFormat::I420A);
MOZ_ASSERT(mImage->AsPlanarYCbCrImage()->GetData()->mAlpha);
return copyPlane(
- mImage->AsPlanarYCbCrImage()->GetData()->mAlpha->mChannel);
+ mImage->AsPlanarYCbCrImage()->GetData()->mAlpha->mChannel,
+ Stride(aPlane));
}
MOZ_ASSERT_UNREACHABLE("invalid plane");
}
@@ -2870,9 +2874,11 @@ bool VideoFrame::Resource::CopyTo(const Format::Plane& aPlane,
if (mImage->GetFormat() == ImageFormat::NV_IMAGE) {
switch (aPlane) {
case Format::Plane::Y:
- return copyPlane(mImage->AsNVImage()->GetData()->mYChannel);
+ return copyPlane(mImage->AsNVImage()->GetData()->mYChannel,
+ Stride(aPlane));
case Format::Plane::UV:
- return copyPlane(mImage->AsNVImage()->GetData()->mCbChannel);
+ return copyPlane(mImage->AsNVImage()->GetData()->mCbChannel,
+ Stride(aPlane));
case Format::Plane::V:
case Format::Plane::A:
MOZ_ASSERT_UNREACHABLE("invalid plane");
@@ -2946,7 +2952,7 @@ bool VideoFrame::Resource::CopyTo(const Format::Plane& aPlane,
return false;
}
- return copyPlane(tempMap.GetData());
+ return copyPlane(tempMap.GetData(), tempMap.GetStride());
}
#undef LOGW
Loading diff…
References
On This Page