Firefox · DOM
CVE-2026-6751
Uninitialized Memory in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
fordom/media/webcodecs/AudioData.cpp |
modified |
Files Changed
dom/media/webcodecs/AudioData.cpp
Patch
diff --git a/dom/media/webcodecs/AudioData.cpp b/dom/media/webcodecs/AudioData.cpp
index bceea375956..916a6be3df1 100644
--- a/dom/media/webcodecs/AudioData.cpp
+++ b/dom/media/webcodecs/AudioData.cpp
@@ -510,12 +510,12 @@ void CopySamples(Span<S> aSource, Span<D> aDest, uint32_t aSourceChannelCount,
MOZ_ASSERT(aSource.Length() -
aCopyToSpec.mFrameOffset * aSourceChannelCount >=
aCopyToSpec.mFrameCount * aSourceChannelCount);
+ MOZ_ASSERT(aSource.Length() % aSourceChannelCount == 0);
+ size_t framesPerPlane = aSource.Length() / aSourceChannelCount;
size_t writeIndex = 0;
- // Scan the source linearly and put each sample at the right position in the
- // destination interleaved buffer.
- size_t readIndex = 0;
for (size_t channel = 0; channel < aSourceChannelCount; channel++) {
writeIndex = channel;
+ size_t readIndex = channel * framesPerPlane + aCopyToSpec.mFrameOffset;
for (size_t i = 0; i < aCopyToSpec.mFrameCount; i++) {
aDest[writeIndex] = ConvertAudioSample<D>(aSource[readIndex]);
readIndex++;
Loading diff…
References
On This Page