Firefox · Networking
CVE-2024-10461
Logic Error in Networking
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
netwerk/streamconv/converters/nsMultiMixedConv.cppnetwerk/streamconv/converters/nsMultiMixedConv.h
Patch
diff --git a/netwerk/streamconv/converters/nsMultiMixedConv.cpp b/netwerk/streamconv/converters/nsMultiMixedConv.cpp
index e1ccfda303c..5c4ea72a86e 100644
--- a/netwerk/streamconv/converters/nsMultiMixedConv.cpp
+++ b/netwerk/streamconv/converters/nsMultiMixedConv.cpp
@@ -474,6 +474,12 @@ nsMultiMixedConv::OnStartRequest(nsIRequest* request) {
if (NS_SUCCEEDED(rv)) {
mRootContentSecurityPolicy = csp;
}
+ nsCString contentDisposition;
+ rv = httpChannel->GetResponseHeader("content-disposition"_ns,
+ contentDisposition);
+ if (NS_SUCCEEDED(rv)) {
+ mRootContentDisposition = contentDisposition;
+ }
} else {
// try asking the channel directly
rv = mChannel->GetContentType(contentType);
@@ -850,7 +856,11 @@ nsresult nsMultiMixedConv::SendStart() {
rv = mPartChannel->SetContentLength(mContentLength);
if (NS_FAILED(rv)) return rv;
- mPartChannel->SetContentDisposition(mContentDisposition);
+ if (!mRootContentDisposition.IsEmpty()) {
+ mPartChannel->SetContentDisposition(mRootContentDisposition);
+ } else {
+ mPartChannel->SetContentDisposition(mContentDisposition);
+ }
// Each part of a multipart/replace response can be used
// for the top level document. We must inform upper layers
diff --git a/netwerk/streamconv/converters/nsMultiMixedConv.h b/netwerk/streamconv/converters/nsMultiMixedConv.h
index 4f773a69eb6..694150d69c2 100644
--- a/netwerk/streamconv/converters/nsMultiMixedConv.h
+++ b/netwerk/streamconv/converters/nsMultiMixedConv.h
@@ -151,15 +151,17 @@ class nsMultiMixedConv : public nsIStreamConverter {
nsCOMPtr<nsIStreamListener> mFinalListener; // this guy gets the converted
// data via his OnDataAvailable()
- nsCOMPtr<nsIChannel>
- mChannel; // The channel as we get in in OnStartRequest call
- RefPtr<nsPartChannel> mPartChannel; // the channel for the given part we're
- // processing. one channel per part.
+ // The channel as we get it in OnStartRequest call
+ nsCOMPtr<nsIChannel> mChannel;
+ // the channel for the given part we're
+ // processing. one channel per part.
+ RefPtr<nsPartChannel> mPartChannel;
nsCOMPtr<nsISupports> mContext;
nsCString mContentType;
nsCString mContentDisposition;
nsCString mContentSecurityPolicy;
nsCString mRootContentSecurityPolicy;
+ nsCString mRootContentDisposition;
uint64_t mContentLength{UINT64_MAX};
uint64_t mTotalSent{0};
Loading diff…
References
On This Page