High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionInformation disclosure in the Graphics: Text component
ComponentGraphics
Bug ClassLogic Error
Tracker2057808
Fix commit67ef6f6c26b3 (firefox) +3/-1
CISA KEVNot listed
CreditedAbdulaziz Alasaiqah
Disclosed2026-08-18

Files Changed

  • gfx/thebes/gfxOTSUtils.h
diff --git a/gfx/thebes/gfxOTSUtils.h b/gfx/thebes/gfxOTSUtils.h
index b0bb74339b0..b5ebb8db482 100644
--- a/gfx/thebes/gfxOTSUtils.h
+++ b/gfx/thebes/gfxOTSUtils.h
@@ -29,7 +29,8 @@ class gfxOTSExpandingMemoryStream : public ots::OTSStream {
   explicit gfxOTSExpandingMemoryStream(size_t initial,
                                        size_t limit = DEFAULT_LIMIT)
       : mLength(initial), mLimit(limit), mOff(0) {
-    mPtr = mAlloc.Grow(nullptr, mLength);
+    mPtr = mAlloc.Grow(nullptr, initial);
+    std::memset(mPtr, 0, initial);
   }
 
   ~gfxOTSExpandingMemoryStream() { mAlloc.Free(mPtr); }
@@ -59,6 +60,7 @@ class gfxOTSExpandingMemoryStream : public ots::OTSStream {
         newLength = mLimit;
       }
       mPtr = mAlloc.Grow(mPtr, newLength);
+      std::memset(static_cast<char*>(mPtr) + mLength, 0, newLength - mLength);
       mLength = newLength;
       return WriteRaw(data, length);
     }
Loading diff…