Firefox · DOM
CVE-2026-92043
Logic Error in DOM
Overview
Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/media/platforms/wmf/WMFDataEncoderUtils.cppdom/media/platforms/wmf/WMFDataEncoderUtils.hdom/media/platforms/wmf/WMFEncoderModule.cpp
Patch
diff --git a/dom/media/platforms/wmf/WMFDataEncoderUtils.cpp b/dom/media/platforms/wmf/WMFDataEncoderUtils.cpp
index 93434b82ab1..aabdb0ca9e6 100644
--- a/dom/media/platforms/wmf/WMFDataEncoderUtils.cpp
+++ b/dom/media/platforms/wmf/WMFDataEncoderUtils.cpp
@@ -32,6 +32,10 @@ GUID CodecToSubtype(CodecType aCodec) {
}
}
+bool IsFrameSizeSupportedForNV12Input(const gfx::IntSize& aSize) {
+ return aSize.width % 2 == 0;
+}
+
static bool IsNotRealtimeOrHwRequired(const EncoderConfig& aConfig) {
// Some hardware encoders have poor realtime performance, as measured by the
// latency between frames. If the config is not realtime, or hardware is
diff --git a/dom/media/platforms/wmf/WMFDataEncoderUtils.h b/dom/media/platforms/wmf/WMFDataEncoderUtils.h
index f8973d7064b..9ad9803027e 100644
--- a/dom/media/platforms/wmf/WMFDataEncoderUtils.h
+++ b/dom/media/platforms/wmf/WMFDataEncoderUtils.h
@@ -35,6 +35,11 @@ extern LazyLogModule sPEMLog;
GUID CodecToSubtype(CodecType aCodec);
+// Whether the NV12 buffer fed to the MFT can be laid out for aSize. Applies
+// whatever the source format, since the MFT's input type is always NV12: the
+// single stride of aSize.width is short of a chroma row at odd widths.
+bool IsFrameSizeSupportedForNV12Input(const gfx::IntSize& aSize);
+
media::EncodeSupportSet CanCreateWMFEncoder(const EncoderConfig& aConfig);
already_AddRefed<MediaByteBuffer> ParseH264Parameters(
diff --git a/dom/media/platforms/wmf/WMFEncoderModule.cpp b/dom/media/platforms/wmf/WMFEncoderModule.cpp
index 681449e4e66..9cede1e7c8f 100644
--- a/dom/media/platforms/wmf/WMFEncoderModule.cpp
+++ b/dom/media/platforms/wmf/WMFEncoderModule.cpp
@@ -39,6 +39,12 @@ EncodeSupportSet WMFEncoderModule::Supports(
if (aConfig.IsAudio()) {
return EncodeSupportSet{};
}
+ // Declining here rather than failing per frame lets PEMFactory fall through
+ // to an encoder that can produce the requested size. Matters for VP8 and VP9,
+ // which can express an odd width; H.264 cannot and is declined above.
+ if (!IsFrameSizeSupportedForNV12Input(aConfig.mSize)) {
+ return EncodeSupportSet{};
+ }
if (aConfig.mScalabilityMode != ScalabilityMode::None &&
aConfig.mCodec != CodecType::H264) {
return EncodeSupportSet{};
Loading diff…
References
On This Page