Firefox · DOM
CVE-2026-74934
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
switchdom/canvas/WebGLFramebuffer.cpp |
modified |
Files Changed
dom/canvas/WebGLFramebuffer.cpp
Patch
diff --git a/dom/canvas/WebGLFramebuffer.cpp b/dom/canvas/WebGLFramebuffer.cpp
index b07bad434c8..7afe36ab0d3 100644
--- a/dom/canvas/WebGLFramebuffer.cpp
+++ b/dom/canvas/WebGLFramebuffer.cpp
@@ -890,6 +890,11 @@ void WebGLFramebuffer::ResolveAttachmentData() const {
const uint32_t drawBuffer =
cur->mAttachmentPoint - LOCAL_GL_COLOR_ATTACHMENT0;
MOZ_ASSERT(drawBuffer <= 100);
+ std::vector<GLenum> drawBuffersForClear(drawBuffer + 1,
+ LOCAL_GL_ONE);
+ drawBuffersForClear[drawBuffer] = cur->mAttachmentPoint;
+ gl->fDrawBuffers(drawBuffersForClear.size(),
+ drawBuffersForClear.data());
switch (format->componentType) {
case webgl::ComponentType::Int:
gl->fClearBufferiv(LOCAL_GL_COLOR, drawBuffer, iZeros);
@@ -921,6 +926,7 @@ void WebGLFramebuffer::ResolveAttachmentData() const {
}
imageInfo->mUninitializedSlices.reset();
}
+ RefreshDrawBuffers();
return;
}
Loading diff…
References
On This Page