Firefox · Graphics
CVE-2026-74973
UAF in Graphics
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
mSourceSurfacegfx/layers/ipc/SharedRGBImage.cpp |
modified | |
mRecycleAllocatorgfx/layers/ipc/SharedRGBImage.cpp |
modified | |
ifgfx/layers/ipc/SharedRGBImage.cpp |
modified |
Files Changed
gfx/layers/ipc/SharedRGBImage.cppgfx/layers/ipc/SharedRGBImage.h
Patch
diff --git a/gfx/layers/ipc/SharedRGBImage.cpp b/gfx/layers/ipc/SharedRGBImage.cpp
index 135065743bb..d078d5a0877 100644
--- a/gfx/layers/ipc/SharedRGBImage.cpp
+++ b/gfx/layers/ipc/SharedRGBImage.cpp
@@ -51,20 +51,27 @@ class TextureClientForRawBufferAccessAllocationHelper
};
SharedRGBImage::SharedRGBImage(ImageClient* aCompositable)
- : Image(nullptr, ImageFormat::SHARED_RGB), mCompositable(aCompositable) {
+ : Image(nullptr, ImageFormat::SHARED_RGB),
+ mCompositable(aCompositable),
+ mSourceSurface("SharedRGBImage::mSourceSurface") {
MOZ_COUNT_CTOR(SharedRGBImage);
}
SharedRGBImage::SharedRGBImage(TextureClientRecycleAllocator* aRecycleAllocator)
: Image(nullptr, ImageFormat::SHARED_RGB),
- mRecycleAllocator(aRecycleAllocator) {
+ mRecycleAllocator(aRecycleAllocator),
+ mSourceSurface("SharedRGBImage::mSourceSurface") {
MOZ_COUNT_CTOR(SharedRGBImage);
}
SharedRGBImage::~SharedRGBImage() {
MOZ_COUNT_DTOR(SharedRGBImage);
- NS_ReleaseOnMainThread("SharedRGBImage::mSourceSurface",
- mSourceSurface.forget());
+ RefPtr<gfx::SourceSurface> surface;
+ {
+ auto guard = mSourceSurface.Lock();
+ surface = guard->forget();
+ }
+ NS_ReleaseOnMainThread("SharedRGBImage::mSourceSurface", surface.forget());
}
TextureClientRecycleAllocator* SharedRGBImage::RecycleAllocator() {
@@ -110,10 +117,10 @@ static void ReleaseTextureClient(void* aData) {
static gfx::UserDataKey sTextureClientKey;
already_AddRefed<gfx::SourceSurface> SharedRGBImage::GetAsSourceSurface() {
- NS_ASSERTION(NS_IsMainThread(), "Must be main thread");
+ auto guard = mSourceSurface.Lock();
- if (mSourceSurface) {
- RefPtr<gfx::SourceSurface> surface(mSourceSurface);
+ if (*guard) {
+ RefPtr<gfx::SourceSurface> surface(*guard);
return surface.forget();
}
@@ -148,7 +155,7 @@ already_AddRefed<gfx::SourceSurface> SharedRGBImage::GetAsSourceSurface() {
}
}
- mSourceSurface = surface;
+ *guard = surface;
return surface.forget();
}
diff --git a/gfx/layers/ipc/SharedRGBImage.h b/gfx/layers/ipc/SharedRGBImage.h
index 77a5cb471df..1151d4880fc 100644
--- a/gfx/layers/ipc/SharedRGBImage.h
+++ b/gfx/layers/ipc/SharedRGBImage.h
@@ -10,6 +10,7 @@
#include "ImageContainer.h" // for ISharedImage, Image, etc
#include "gfxTypes.h"
+#include "mozilla/DataMutex.h" // for DataMutex
#include "mozilla/RefPtr.h" // for RefPtr
#include "mozilla/gfx/Point.h" // for IntSize
#include "mozilla/gfx/Types.h" // for SurfaceFormat
@@ -49,7 +50,7 @@ class SharedRGBImage : public Image {
RefPtr<TextureClient> mTextureClient;
RefPtr<ImageClient> mCompositable;
RefPtr<TextureClientRecycleAllocator> mRecycleAllocator;
- RefPtr<gfx::SourceSurface> mSourceSurface;
+ DataMutex<RefPtr<gfx::SourceSurface>> mSourceSurface;
};
} // namespace layers
Loading diff…
References
On This Page