tor-browser

commit 0104c6562a3efe8702d5476188f61f159c180f77
parent 4b68abebc41b8ab49286a0d52f07c080e41346c1
Author: Lee Salzman <lsalzman@mozilla.com>
Date:   Fri, 21 Nov 2025 00:30:08 +0000

Bug 1996473. r=ahale

Differential Revision: https://phabricator.services.mozilla.com/D270290

Diffstat:
M
dom/canvas/TexUnpackBlob.cpp
 | 
12
+++++++++++-

1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/dom/canvas/TexUnpackBlob.cpp b/dom/canvas/TexUnpackBlob.cpp
@@ -395,7 +395,17 @@ bool TexUnpackBlob::ConvertIfNeeded(
 
   if (!rowLength || !rowCount) return true;
 
-  if (srcStride <= 0 || dstStride <= 0) {
+  auto minSrcStride =
+      CheckedInt<size_t>(
+          WebGLTexelConversions::TexelBytesForFormat(srcFormat)) *
+      rowLength;
+  auto minDstStride =
+      CheckedInt<size_t>(
+          WebGLTexelConversions::TexelBytesForFormat(dstFormat)) *
+      rowLength;
+  if (srcStride <= 0 || dstStride <= 0 || !minSrcStride.isValid() ||
+      !minDstStride.isValid() || size_t(srcStride) < minSrcStride.value() ||
+      size_t(dstStride) < minDstStride.value()) {
     webgl->ErrorInvalidOperation("Invalid stride.");
     return false;
   }