Medium firefox UAF 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionRace condition, use-after-free in the Graphics component
ComponentGraphics
Bug ClassUAF
Tracker2060357
Fix commitae4cc36924af (firefox) +17/-9
CISA KEVNot listed
Creditedr00tdaddy
Disclosed2026-08-18

Changed Functions

FunctionChangeNotes
mSourceSurface
gfx/layers/ipc/SharedRGBImage.cpp
modified
mRecycleAllocator
gfx/layers/ipc/SharedRGBImage.cpp
modified
if
gfx/layers/ipc/SharedRGBImage.cpp
modified

Files Changed

  • gfx/layers/ipc/SharedRGBImage.cpp
  • gfx/layers/ipc/SharedRGBImage.h
diff --git a/gfx/layers/ipc/SharedRGBImage.cpp b/gfx/layers/ipc/SharedRGBImage.cpp
index 135065743bb..d078d5a0877 100644
--- a/gfx/layers/ipc/SharedRGBImage.cpp
+++ b/gfx/layers/ipc/SharedRGBImage.cpp
@@ -51,20 +51,27 @@ class TextureClientForRawBufferAccessAllocationHelper
 };
 
 SharedRGBImage::SharedRGBImage(ImageClient* aCompositable)
-    : Image(nullptr, ImageFormat::SHARED_RGB), mCompositable(aCompositable) {
+    : Image(nullptr, ImageFormat::SHARED_RGB),
+      mCompositable(aCompositable),
+      mSourceSurface("SharedRGBImage::mSourceSurface") {
   MOZ_COUNT_CTOR(SharedRGBImage);
 }
 
 SharedRGBImage::SharedRGBImage(TextureClientRecycleAllocator* aRecycleAllocator)
     : Image(nullptr, ImageFormat::SHARED_RGB),
-      mRecycleAllocator(aRecycleAllocator) {
+      mRecycleAllocator(aRecycleAllocator),
+      mSourceSurface("SharedRGBImage::mSourceSurface") {
   MOZ_COUNT_CTOR(SharedRGBImage);
 }
 
 SharedRGBImage::~SharedRGBImage() {
   MOZ_COUNT_DTOR(SharedRGBImage);
-  NS_ReleaseOnMainThread("SharedRGBImage::mSourceSurface",
-                         mSourceSurface.forget());
+  RefPtr<gfx::SourceSurface> surface;
+  {
+    auto guard = mSourceSurface.Lock();
+    surface = guard->forget();
+  }
+  NS_ReleaseOnMainThread("SharedRGBImage::mSourceSurface", surface.forget());
 }
 
 TextureClientRecycleAllocator* SharedRGBImage::RecycleAllocator() {
@@ -110,10 +117,10 @@ static void ReleaseTextureClient(void* aData) {
 static gfx::UserDataKey sTextureClientKey;
 
 already_AddRefed<gfx::SourceSurface> SharedRGBImage::GetAsSourceSurface() {
-  NS_ASSERTION(NS_IsMainThread(), "Must be main thread");
+  auto guard = mSourceSurface.Lock();
 
-  if (mSourceSurface) {
-    RefPtr<gfx::SourceSurface> surface(mSourceSurface);
+  if (*guard) {
+    RefPtr<gfx::SourceSurface> surface(*guard);
     return surface.forget();
   }
 
@@ -148,7 +155,7 @@ already_AddRefed<gfx::SourceSurface> SharedRGBImage::GetAsSourceSurface() {
     }
   }
 
-  mSourceSurface = surface;
+  *guard = surface;
   return surface.forget();
 }
 
diff --git a/gfx/layers/ipc/SharedRGBImage.h b/gfx/layers/ipc/SharedRGBImage.h
index 77a5cb471df..1151d4880fc 100644
--- a/gfx/layers/ipc/SharedRGBImage.h
+++ b/gfx/layers/ipc/SharedRGBImage.h
@@ -10,6 +10,7 @@
 
 #include "ImageContainer.h"  // for ISharedImage, Image, etc
 #include "gfxTypes.h"
+#include "mozilla/DataMutex.h"  // for DataMutex
 #include "mozilla/RefPtr.h"     // for RefPtr
 #include "mozilla/gfx/Point.h"  // for IntSize
 #include "mozilla/gfx/Types.h"  // for SurfaceFormat
@@ -49,7 +50,7 @@ class SharedRGBImage : public Image {
   RefPtr<TextureClient> mTextureClient;
   RefPtr<ImageClient> mCompositable;
   RefPtr<TextureClientRecycleAllocator> mRecycleAllocator;
-  RefPtr<gfx::SourceSurface> mSourceSurface;
+  DataMutex<RefPtr<gfx::SourceSurface>> mSourceSurface;
 };
 
 }  // namespace layers
Loading diff…