High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the Graphics: ImageLib component
ComponentImageLib
Bug ClassUAF
Tracker2057308
Fix commit55dc28955415 (firefox) +10/-12
CISA KEVNot listed
CreditedAbdulaziz Alasaiqah
Disclosed2026-08-18

Changed Functions

FunctionChangeNotes
if
image/RasterImage.cpp
modified

Files Changed

  • image/RasterImage.cpp
  • image/RasterImage.h
diff --git a/image/RasterImage.cpp b/image/RasterImage.cpp
index 25cd5d034db..318d72e061c 100644
--- a/image/RasterImage.cpp
+++ b/image/RasterImage.cpp
@@ -76,8 +76,6 @@ RasterImage::RasterImage(nsIURI* aURI /* = nullptr */)
 
 //******************************************************************************
 RasterImage::~RasterImage() {
-  mIsBeingDestroyed = true;
-
   // Make sure our SourceBuffer is marked as complete. This will ensure that any
   // outstanding decoders terminate.
   if (!mSourceBuffer->IsComplete()) {
@@ -486,19 +484,21 @@ RasterImage::WillDrawOpaqueNow() {
 void RasterImage::OnSurfaceDiscarded(const SurfaceKey& aSurfaceKey) {
   MOZ_ASSERT(mProgressTracker);
 
-  if (mIsBeingDestroyed) {
-    return;
-  }
-
   bool animatedFramesDiscarded =
       aSurfaceKey.Playback() == PlaybackType::eAnimated;
 
   nsCOMPtr<nsIEventTarget> eventTarget = do_GetMainThread();
 
-  RefPtr<RasterImage> image = this;
-  nsCOMPtr<nsIRunnable> ev =
-      NS_NewRunnableFunction("RasterImage::OnSurfaceDiscarded", [=]() -> void {
-        image->OnSurfaceDiscardedInternal(animatedFramesDiscarded);
+  RefPtr<ProgressTracker> progressTracker = mProgressTracker;
+  nsCOMPtr<nsIRunnable> ev = NS_NewRunnableFunction(
+      "RasterImage::OnSurfaceDiscarded",
+      [progressTracker, animatedFramesDiscarded]() -> void {
+        RefPtr<Image> image = progressTracker->GetImage();
+        if (!image) {
+          return;
+        }
+        static_cast<RasterImage*>(image.get())
+            ->OnSurfaceDiscardedInternal(animatedFramesDiscarded);
       });
   eventTarget->Dispatch(ev.forget(), NS_DISPATCH_NORMAL);
 }
diff --git a/image/RasterImage.h b/image/RasterImage.h
index 7b7bba84196..30e90640dfb 100644
--- a/image/RasterImage.h
+++ b/image/RasterImage.h
@@ -380,8 +380,6 @@ class RasterImage final : public ImageResource,
   // This is currently only used for statistics
   int32_t mDecodeCount;
 
-  Atomic<bool> mIsBeingDestroyed{false};
-
 #ifdef DEBUG
   uint32_t mFramesNotified;
 #endif
Loading diff…