2 files changed, 11 insertions, 0 deletions
diff --git a/image/decoders/icon/nsIconURI.cpp b/image/decoders/icon/nsIconURI.cpp
index 632a733fe..473ded218 100644
--- a/image/decoders/icon/nsIconURI.cpp
+++ b/image/decoders/icon/nsIconURI.cpp
@@ -688,7 +688,17 @@ nsMozIconURI::Deserialize(const URIParams& aParams)
   mContentType = params.contentType();
   mFileName = params.fileName();
   mStockIcon = params.stockIcon();
+
+  if (params.iconSize() < -1 ||
+      params.iconSize() >= (int32_t) ArrayLength(kSizeStrings)) {
+    return false;
+  }
   mIconSize = params.iconSize();
+
+  if (params.iconState() < -1 ||
+      params.iconState() >= (int32_t) ArrayLength(kStateStrings)) {
+    return false;
+  }
   mIconState = params.iconState();
 
   return true;
diff --git a/image/decoders/nsWebPDecoder.cpp b/image/decoders/nsWebPDecoder.cpp
index 5da696347..6ed2c3e9c 100644
--- a/image/decoders/nsWebPDecoder.cpp
+++ b/image/decoders/nsWebPDecoder.cpp
@@ -119,6 +119,7 @@ nsWebPDecoder::EndFrame()
        mTimeout.AsEncodedValueDeprecated(), (int)mBlend));
 
   PostFrameStop(opacity, mDisposal, mTimeout, mBlend);
+  WebPFreeDecBuffer(&mBuffer);
   WebPIDelete(mDecoder);
   mDecoder = nullptr;
   mLastRow = 0;