Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionPrivilege escalation due to incorrect boundary conditions in the Audio/Video component
ComponentDOM
Bug ClassLogic Error
Tracker2050150
Fix commitcc4b52c57717 (firefox) +15/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-15

Files Changed

  • dom/media/platforms/wmf/WMFDataEncoderUtils.cpp
  • dom/media/platforms/wmf/WMFDataEncoderUtils.h
  • dom/media/platforms/wmf/WMFEncoderModule.cpp
diff --git a/dom/media/platforms/wmf/WMFDataEncoderUtils.cpp b/dom/media/platforms/wmf/WMFDataEncoderUtils.cpp
index 93434b82ab1..aabdb0ca9e6 100644
--- a/dom/media/platforms/wmf/WMFDataEncoderUtils.cpp
+++ b/dom/media/platforms/wmf/WMFDataEncoderUtils.cpp
@@ -32,6 +32,10 @@ GUID CodecToSubtype(CodecType aCodec) {
   }
 }
 
+bool IsFrameSizeSupportedForNV12Input(const gfx::IntSize& aSize) {
+  return aSize.width % 2 == 0;
+}
+
 static bool IsNotRealtimeOrHwRequired(const EncoderConfig& aConfig) {
   // Some hardware encoders have poor realtime performance, as measured by the
   // latency between frames. If the config is not realtime, or hardware is
diff --git a/dom/media/platforms/wmf/WMFDataEncoderUtils.h b/dom/media/platforms/wmf/WMFDataEncoderUtils.h
index f8973d7064b..9ad9803027e 100644
--- a/dom/media/platforms/wmf/WMFDataEncoderUtils.h
+++ b/dom/media/platforms/wmf/WMFDataEncoderUtils.h
@@ -35,6 +35,11 @@ extern LazyLogModule sPEMLog;
 
 GUID CodecToSubtype(CodecType aCodec);
 
+// Whether the NV12 buffer fed to the MFT can be laid out for aSize. Applies
+// whatever the source format, since the MFT's input type is always NV12: the
+// single stride of aSize.width is short of a chroma row at odd widths.
+bool IsFrameSizeSupportedForNV12Input(const gfx::IntSize& aSize);
+
 media::EncodeSupportSet CanCreateWMFEncoder(const EncoderConfig& aConfig);
 
 already_AddRefed<MediaByteBuffer> ParseH264Parameters(
diff --git a/dom/media/platforms/wmf/WMFEncoderModule.cpp b/dom/media/platforms/wmf/WMFEncoderModule.cpp
index 681449e4e66..9cede1e7c8f 100644
--- a/dom/media/platforms/wmf/WMFEncoderModule.cpp
+++ b/dom/media/platforms/wmf/WMFEncoderModule.cpp
@@ -39,6 +39,12 @@ EncodeSupportSet WMFEncoderModule::Supports(
   if (aConfig.IsAudio()) {
     return EncodeSupportSet{};
   }
+  // Declining here rather than failing per frame lets PEMFactory fall through
+  // to an encoder that can produce the requested size. Matters for VP8 and VP9,
+  // which can express an odd width; H.264 cannot and is declined above.
+  if (!IsFrameSizeSupportedForNV12Input(aConfig.mSize)) {
+    return EncodeSupportSet{};
+  }
   if (aConfig.mScalabilityMode != ScalabilityMode::None &&
       aConfig.mCodec != CodecType::H264) {
     return EncodeSupportSet{};
Loading diff…