Medium firefox Memory Corruption 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionMemory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentNetworking
Bug ClassMemory Corruption
Tracker1829029
Fix commit0e2d2fc47aed (firefox) +11/-8
CISA KEVNot listed
CreditedAndrew McCreight, the Mozilla Fuzzing Team
Disclosed2024-10-29

Changed Functions

FunctionChangeNotes
mSize
netwerk/cache2/CacheFileIOManager.cpp
modified
if
netwerk/cache2/CacheFileIOManager.cpp
modified

Files Changed

  • netwerk/cache2/CacheFileIOManager.cpp
diff --git a/netwerk/cache2/CacheFileIOManager.cpp b/netwerk/cache2/CacheFileIOManager.cpp
index 85cd017d8b9..b4f986929e3 100644
--- a/netwerk/cache2/CacheFileIOManager.cpp
+++ b/netwerk/cache2/CacheFileIOManager.cpp
@@ -4410,13 +4410,15 @@ class SizeOfHandlesRunnable : public Runnable {
  public:
   SizeOfHandlesRunnable(mozilla::MallocSizeOf mallocSizeOf,
                         CacheFileHandles const& handles,
-                        nsTArray<CacheFileHandle*> const& specialHandles)
+                        nsTArray<CacheFileHandle*> const& specialHandles,
+                        nsCOMPtr<nsITimer> const& metadataWritesTimer)
       : Runnable("net::SizeOfHandlesRunnable"),
         mMonitor("SizeOfHandlesRunnable.mMonitor"),
         mMonitorNotified(false),
         mMallocSizeOf(mallocSizeOf),
         mHandles(handles),
         mSpecialHandles(specialHandles),
+        mMetadataWritesTimer(metadataWritesTimer),
         mSize(0) {}
 
   size_t Get(CacheIOThread* thread) {
@@ -4448,6 +4450,8 @@ class SizeOfHandlesRunnable : public Runnable {
     for (uint32_t i = 0; i < mSpecialHandles.Length(); ++i) {
       mSize += mSpecialHandles[i]->SizeOfIncludingThis(mMallocSizeOf);
     }
+    nsCOMPtr<nsISizeOf> sizeOf = do_QueryInterface(mMetadataWritesTimer);
+    if (sizeOf) mSize += sizeOf->SizeOfIncludingThis(mallocSizeOf);
 
     mMonitorNotified = true;
     mon.Notify();
@@ -4455,11 +4459,12 @@ class SizeOfHandlesRunnable : public Runnable {
   }
 
  private:
-  mozilla::Monitor mMonitor MOZ_UNANNOTATED;
+  mozilla::Monitor mMonitor;
   bool mMonitorNotified;
   mozilla::MallocSizeOf mMallocSizeOf;
   CacheFileHandles const& mHandles;
   nsTArray<CacheFileHandle*> const& mSpecialHandles;
+  nsCOMPtr<nsITimer> const& mMetadataWritesTimer;
   size_t mSize;
 };
 
@@ -4473,10 +4478,11 @@ size_t CacheFileIOManager::SizeOfExcludingThisInternal(
   if (mIOThread) {
     n += mIOThread->SizeOfIncludingThis(mallocSizeOf);
 
-    // mHandles and mSpecialHandles must be accessed only on the I/O thread,
-    // must sync dispatch.
+    // mHandles, mSpecialHandles and mMetadataWritesTimer must be accessed
+    // only on the I/O thread, must sync dispatch.
     RefPtr<SizeOfHandlesRunnable> sizeOfHandlesRunnable =
-        new SizeOfHandlesRunnable(mallocSizeOf, mHandles, mSpecialHandles);
+        new SizeOfHandlesRunnable(mallocSizeOf, mHandles, mSpecialHandles,
+                                  mMetadataWritesTimer);
     n += sizeOfHandlesRunnable->Get(mIOThread);
   }
 
@@ -4485,9 +4491,6 @@ size_t CacheFileIOManager::SizeOfExcludingThisInternal(
   sizeOf = do_QueryInterface(mCacheDirectory);
   if (sizeOf) n += sizeOf->SizeOfIncludingThis(mallocSizeOf);
 
-  sizeOf = do_QueryInterface(mMetadataWritesTimer);
-  if (sizeOf) n += sizeOf->SizeOfIncludingThis(mallocSizeOf);
-
   sizeOf = do_QueryInterface(mTrashTimer);
   if (sizeOf) n += sizeOf->SizeOfIncludingThis(mallocSizeOf);
 
Loading diff…