Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionSandbox escape due to invalid pointer in the Graphics component
ComponentGraphics
Bug ClassLogic Error
Tracker2068437
Fix commit6a8b28132e12 (firefox) +16/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-15

Files Changed

  • gfx/2d/DrawTargetCairo.cpp
  • gfx/2d/DrawTargetCairo.h
diff --git a/gfx/2d/DrawTargetCairo.cpp b/gfx/2d/DrawTargetCairo.cpp
index f56d622d06d..e419e6a37e1 100644
--- a/gfx/2d/DrawTargetCairo.cpp
+++ b/gfx/2d/DrawTargetCairo.cpp
@@ -1896,6 +1896,10 @@ DrawTargetCairo::CreateSourceSurfaceFromNativeSurface(
 
 already_AddRefed<DrawTarget> DrawTargetCairo::CreateSimilarDrawTarget(
     const IntSize& aSize, SurfaceFormat aFormat) const {
+  if (!CanCreateSimilarDrawTarget(aSize, aFormat)) {
+    return nullptr;
+  }
+
   if (cairo_surface_status(cairo_get_group_target(mContext))) {
     RefPtr target = MakeRefPtr<DrawTargetCairo>();
     if (target->Init(aSize, aFormat)) {
@@ -1946,6 +1950,12 @@ already_AddRefed<DrawTarget> DrawTargetCairo::CreateSimilarDrawTarget(
   return nullptr;
 }
 
+bool DrawTargetCairo::CanCreateSimilarDrawTarget(const IntSize& aSize,
+                                                 SurfaceFormat aFormat) const {
+  // Ensure that surface indexes fit in an int32_t.
+  return Factory::CheckSurfaceSize(aSize);
+}
+
 RefPtr<DrawTarget> DrawTargetCairo::CreateClippedDrawTarget(
     const Rect& aBounds, SurfaceFormat aFormat) {
   RefPtr<DrawTarget> result;
@@ -2069,6 +2079,10 @@ bool DrawTargetCairo::Init(cairo_surface_t* aSurface, const IntSize& aSize,
 }
 
 bool DrawTargetCairo::Init(const IntSize& aSize, SurfaceFormat aFormat) {
+  if (!Factory::CheckSurfaceSize(aSize)) {
+    return false;
+  }
+
   cairo_surface_t* surf = cairo_image_surface_create(
       GfxFormatToCairoFormat(aFormat), aSize.width, aSize.height);
   return InitAlreadyReferenced(surf, aSize);
diff --git a/gfx/2d/DrawTargetCairo.h b/gfx/2d/DrawTargetCairo.h
index fe51d89b73b..232cd62f15c 100644
--- a/gfx/2d/DrawTargetCairo.h
+++ b/gfx/2d/DrawTargetCairo.h
@@ -142,6 +142,8 @@ class DrawTargetCairo final : public DrawTarget {
       const NativeSurface& aSurface) const override;
   already_AddRefed<DrawTarget> CreateSimilarDrawTarget(
       const IntSize& aSize, SurfaceFormat aFormat) const override;
+  bool CanCreateSimilarDrawTarget(const IntSize& aSize,
+                                  SurfaceFormat aFormat) const override;
   already_AddRefed<DrawTarget> CreateShadowDrawTarget(
       const IntSize& aSize, SurfaceFormat aFormat, float aSigma) const override;
   RefPtr<DrawTarget> CreateClippedDrawTarget(const Rect& aBounds,
Loading diff…