Firefox · Graphics
CVE-2026-92032
Logic Error in Graphics
Overview
Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
gfx/2d/DrawTargetCairo.cppgfx/2d/DrawTargetCairo.h
Patch
diff --git a/gfx/2d/DrawTargetCairo.cpp b/gfx/2d/DrawTargetCairo.cpp
index f56d622d06d..e419e6a37e1 100644
--- a/gfx/2d/DrawTargetCairo.cpp
+++ b/gfx/2d/DrawTargetCairo.cpp
@@ -1896,6 +1896,10 @@ DrawTargetCairo::CreateSourceSurfaceFromNativeSurface(
already_AddRefed<DrawTarget> DrawTargetCairo::CreateSimilarDrawTarget(
const IntSize& aSize, SurfaceFormat aFormat) const {
+ if (!CanCreateSimilarDrawTarget(aSize, aFormat)) {
+ return nullptr;
+ }
+
if (cairo_surface_status(cairo_get_group_target(mContext))) {
RefPtr target = MakeRefPtr<DrawTargetCairo>();
if (target->Init(aSize, aFormat)) {
@@ -1946,6 +1950,12 @@ already_AddRefed<DrawTarget> DrawTargetCairo::CreateSimilarDrawTarget(
return nullptr;
}
+bool DrawTargetCairo::CanCreateSimilarDrawTarget(const IntSize& aSize,
+ SurfaceFormat aFormat) const {
+ // Ensure that surface indexes fit in an int32_t.
+ return Factory::CheckSurfaceSize(aSize);
+}
+
RefPtr<DrawTarget> DrawTargetCairo::CreateClippedDrawTarget(
const Rect& aBounds, SurfaceFormat aFormat) {
RefPtr<DrawTarget> result;
@@ -2069,6 +2079,10 @@ bool DrawTargetCairo::Init(cairo_surface_t* aSurface, const IntSize& aSize,
}
bool DrawTargetCairo::Init(const IntSize& aSize, SurfaceFormat aFormat) {
+ if (!Factory::CheckSurfaceSize(aSize)) {
+ return false;
+ }
+
cairo_surface_t* surf = cairo_image_surface_create(
GfxFormatToCairoFormat(aFormat), aSize.width, aSize.height);
return InitAlreadyReferenced(surf, aSize);
diff --git a/gfx/2d/DrawTargetCairo.h b/gfx/2d/DrawTargetCairo.h
index fe51d89b73b..232cd62f15c 100644
--- a/gfx/2d/DrawTargetCairo.h
+++ b/gfx/2d/DrawTargetCairo.h
@@ -142,6 +142,8 @@ class DrawTargetCairo final : public DrawTarget {
const NativeSurface& aSurface) const override;
already_AddRefed<DrawTarget> CreateSimilarDrawTarget(
const IntSize& aSize, SurfaceFormat aFormat) const override;
+ bool CanCreateSimilarDrawTarget(const IntSize& aSize,
+ SurfaceFormat aFormat) const override;
already_AddRefed<DrawTarget> CreateShadowDrawTarget(
const IntSize& aSize, SurfaceFormat aFormat, float aSigma) const override;
RefPtr<DrawTarget> CreateClippedDrawTarget(const Rect& aBounds,
Loading diff…
References
On This Page