Medium firefox Memory Corruption 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionMemory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentDOM
Bug ClassMemory Corruption
Tracker1827142
Fix commit7ff2c73af1df (firefox) +16/-9
CISA KEVNot listed
CreditedAndrew Osmond and the Mozilla Fuzzing Team
Disclosed2025-01-07

Changed Functions

FunctionChangeNotes
if
dom/media/eme/mediafoundation/WMFCDMImpl.cpp
modified
for
dom/media/eme/mediafoundation/WMFCDMImpl.cpp
modified
mShutdown
dom/media/ipc/MFCDMChild.cpp
modified
if
dom/media/ipc/MFCDMChild.cpp
modified

Files Changed

  • dom/media/eme/mediafoundation/WMFCDMImpl.cpp
  • dom/media/ipc/MFCDMChild.cpp
  • dom/media/ipc/MFCDMChild.h
diff --git a/dom/media/eme/mediafoundation/WMFCDMImpl.cpp b/dom/media/eme/mediafoundation/WMFCDMImpl.cpp
index 9491f4c9ec5..7cc9fe4efd8 100644
--- a/dom/media/eme/mediafoundation/WMFCDMImpl.cpp
+++ b/dom/media/eme/mediafoundation/WMFCDMImpl.cpp
@@ -20,6 +20,7 @@ RefPtr<WMFCDMImpl::InitPromise> WMFCDMImpl::Init(
     const WMFCDMImpl::InitParams& aParams) {
   if (!mCDM) {
     mCDM = MakeRefPtr<MFCDMChild>(mKeySystem);
+    mCDM->EnsureRemote();
   }
   RefPtr<WMFCDMImpl> self = this;
   mCDM->Init(aParams.mOrigin, aParams.mInitDataTypes,
@@ -58,6 +59,7 @@ WMFCDMCapabilites::GetCapabilities(
   nsTArray<RefPtr<CapabilitiesPromise>> promises;
   for (const auto& request : aRequests) {
     RefPtr<MFCDMChild> cdm = new MFCDMChild(request.mKeySystem);
+    cdm->EnsureRemote();
     promises.AppendElement(cdm->GetCapabilities(MFCDMCapabilitiesRequest{
         nsString{request.mKeySystem},
         request.mDecryption == KeySystemConfig::DecryptionInfo::Hardware,
diff --git a/dom/media/ipc/MFCDMChild.cpp b/dom/media/ipc/MFCDMChild.cpp
index 9df86b82f47..4cbc7403970 100644
--- a/dom/media/ipc/MFCDMChild.cpp
+++ b/dom/media/ipc/MFCDMChild.cpp
@@ -73,19 +73,25 @@ MFCDMChild::MFCDMChild(const nsAString& aKeySystem)
     : mKeySystem(aKeySystem),
       mManagerThread(RemoteDecoderManagerChild::GetManagerThread()),
       mState(NS_ERROR_NOT_INITIALIZED),
-      mShutdown(false) {
-  mRemotePromise = EnsureRemote();
-}
+      mShutdown(false) {}
 
 MFCDMChild::~MFCDMChild() {}
 
-RefPtr<MFCDMChild::RemotePromise> MFCDMChild::EnsureRemote() {
+void MFCDMChild::EnsureRemote() {
+  if (mRemotePromise) {
+    LOG("already created remote promise");
+    return;
+  }
+
   if (!mManagerThread) {
     LOG("no manager thread");
     mState = NS_ERROR_NOT_AVAILABLE;
-    return RemotePromise::CreateAndReject(mState, __func__);
+    mRemotePromise = RemotePromise::CreateAndReject(mState, __func__);
+    return;
   }
 
+  mRemotePromise = mRemotePromiseHolder.Ensure(__func__);
+
   RefPtr<MFCDMChild> self = this;
   RemoteDecoderManagerChild::LaunchUtilityProcessIfNeeded(
       RemoteDecodeIn::UtilityProcess_MFMediaEngineCDM)
@@ -115,7 +121,6 @@ RefPtr<MFCDMChild::RemotePromise> MFCDMChild::EnsureRemote() {
             mRemotePromiseHolder.RejectIfExists(rv, __func__);
           })
       ->Track(mRemoteRequest);
-  return mRemotePromiseHolder.Ensure(__func__);
 }
 
 void MFCDMChild::Shutdown() {
diff --git a/dom/media/ipc/MFCDMChild.h b/dom/media/ipc/MFCDMChild.h
index ec766cab248..2f36b9df0d1 100644
--- a/dom/media/ipc/MFCDMChild.h
+++ b/dom/media/ipc/MFCDMChild.h
@@ -85,6 +85,8 @@ class MFCDMChild final : public PMFCDMChild {
       mState = NS_ERROR_NOT_AVAILABLE;
     }
   }
+
+  void EnsureRemote();
   void Shutdown();
 
   nsISerialEventTarget* ManagerThread() { return mManagerThread; }
@@ -95,9 +97,6 @@ class MFCDMChild final : public PMFCDMChild {
  private:
   ~MFCDMChild();
 
-  using RemotePromise = GenericNonExclusivePromise;
-  RefPtr<RemotePromise> EnsureRemote();
-
   void AssertSendable();
 
   const nsString mKeySystem;
@@ -105,6 +104,7 @@ class MFCDMChild final : public PMFCDMChild {
   const RefPtr<nsISerialEventTarget> mManagerThread;
   RefPtr<MFCDMChild> mIPDLSelfRef;
 
+  using RemotePromise = GenericNonExclusivePromise;
   RefPtr<RemotePromise> mRemotePromise;
   MozPromiseHolder<RemotePromise> mRemotePromiseHolder;
   MozPromiseRequestHolder<RemotePromise> mRemoteRequest;
Loading diff…