High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionPrivilege escalation due to incorrect boundary conditions in the Graphics: WebRender component
ComponentGraphics
Bug ClassLogic Error
Tracker2066329
Fix commit2612e906a336 (firefox) +44/-5
CISA KEVNot listed
CreditedRintaro Kawasugi
Disclosed2026-09-15

Changed Functions

FunctionChangeNotes
switch
gfx/wr/swgl/src/swgl_ext.h
modified

Files Changed

  • gfx/wr/swgl/src/swgl_ext.h
diff --git a/gfx/wr/swgl/src/swgl_ext.h b/gfx/wr/swgl/src/swgl_ext.h
index f76feae816e..d2d00207670 100644
--- a/gfx/wr/swgl/src/swgl_ext.h
+++ b/gfx/wr/swgl/src/swgl_ext.h
@@ -1005,6 +1005,17 @@ static ALWAYS_INLINE PackedRGBA8 convertYUV(const YUVMatrix& rgb_from_ycbcr,
   return rgb_from_ycbcr.convert(yy, uv);
 }
 
+template <typename S0>
+static inline bool validYUVFormat(S0 sampler0) {
+  switch (sampler0->format) {
+    case TextureFormat::RGBA8:
+    case TextureFormat::YUY2:
+      return true;
+    default:
+      return false;
+  }
+}
+
 // Helper functions to sample from planar YUV textures before converting to RGB
 template <typename S0>
 static ALWAYS_INLINE PackedRGBA8 sampleYUV(S0 sampler0, ivec2 uv0,
@@ -1031,7 +1042,7 @@ static int blendYUV(P* buf, int span, S0 sampler0, vec2 uv0,
                     const vec4_scalar& uv_rect0, const vec3_scalar& ycbcr_bias,
                     const mat3_scalar& rgb_from_debiased_ycbcr,
                     int rescaleFactor, C color = C()) {
-  if (!swgl_isTextureLinear(sampler0)) {
+  if (!swgl_isTextureLinear(sampler0) || !validYUVFormat(sampler0)) {
     return 0;
   }
   LINEAR_QUANTIZE_UV(sampler0, uv0, uv_step0, uv_rect0, min_uv0, max_uv0);
@@ -1048,6 +1059,20 @@ static int blendYUV(P* buf, int span, S0 sampler0, vec2 uv0,
   return span;
 }
 
+template <typename S0, typename S1>
+static inline bool validYUVFormat(S0 sampler0, S1 sampler1) {
+  switch (sampler1->format) {
+    case TextureFormat::RG8:
+      return sampler0->format == TextureFormat::R8;
+    case TextureFormat::RGBA8:
+      return sampler0->format == TextureFormat::R8;
+    case TextureFormat::RG16:
+      return sampler0->format == TextureFormat::R16;
+    default:
+      return false;
+  }
+}
+
 template <typename S0, typename S1>
 static ALWAYS_INLINE PackedRGBA8 sampleYUV(S0 sampler0, ivec2 uv0, S1 sampler1,
                                            ivec2 uv1,
@@ -1096,7 +1121,8 @@ static int blendYUV(P* buf, int span, S0 sampler0, vec2 uv0,
                     const vec4_scalar& uv_rect1, const vec3_scalar& ycbcr_bias,
                     const mat3_scalar& rgb_from_debiased_ycbcr,
                     int rescaleFactor, C color = C()) {
-  if (!swgl_isTextureLinear(sampler0) || !swgl_isTextureLinear(sampler1)) {
+  if (!swgl_isTextureLinear(sampler0) || !swgl_isTextureLinear(sampler1) ||
+      !validYUVFormat(sampler0, sampler1)) {
     return 0;
   }
   LINEAR_QUANTIZE_UV(sampler0, uv0, uv_step0, uv_rect0, min_uv0, max_uv0);
@@ -1115,6 +1141,18 @@ static int blendYUV(P* buf, int span, S0 sampler0, vec2 uv0,
   return span;
 }
 
+template <typename S0, typename S1, typename S2>
+static inline bool validYUVFormat(S0 sampler0, S1 sampler1, S2 sampler2) {
+  switch (sampler0->format) {
+    case TextureFormat::R8:
+    case TextureFormat::R16:
+      return sampler0->format == sampler1->format &&
+             sampler0->format == sampler2->format;
+    default:
+      return false;
+  }
+}
+
 template <typename S0, typename S1, typename S2>
 static ALWAYS_INLINE PackedRGBA8 sampleYUV(S0 sampler0, ivec2 uv0, S1 sampler1,
                                            ivec2 uv1, S2 sampler2, ivec2 uv2,
@@ -1185,8 +1223,8 @@ static int blendYUV(P* buf, int span, S0 sampler0, vec2 uv0,
                     const mat3_scalar& rgb_from_debiased_ycbcr,
                     int rescaleFactor, C color = C()) {
   if (!swgl_isTextureLinear(sampler0) || !swgl_isTextureLinear(sampler1) ||
-      !swgl_isTextureLinear(sampler2) || sampler0->format != sampler1->format ||
-      sampler0->format != sampler2->format) {
+      !swgl_isTextureLinear(sampler2) ||
+      !validYUVFormat(sampler0, sampler1, sampler2)) {
     return 0;
   }
   LINEAR_QUANTIZE_UV(sampler0, uv0, uv_step0, uv_rect0, min_uv0, max_uv0);
@@ -1217,7 +1255,8 @@ static int blendYUV(uint32_t* buf, int span, sampler2DRect sampler0, vec2 uv0,
                     const mat3_scalar& rgb_from_debiased_ycbcr,
                     int rescaleFactor, NoColor noColor = NoColor()) {
   if (!swgl_isTextureLinear(sampler0) || !swgl_isTextureLinear(sampler1) ||
-      !swgl_isTextureLinear(sampler2)) {
+      !swgl_isTextureLinear(sampler2) ||
+      !validYUVFormat(sampler0, sampler1, sampler2)) {
     return 0;
   }
   LINEAR_QUANTIZE_UV(sampler0, uv0, uv_step0, uv_rect0, min_uv0, max_uv0);
Loading diff…