Firefox · DOM
CVE-2025-0243
Memory Corruption in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/media/eme/mediafoundation/WMFCDMImpl.cpp |
modified | |
fordom/media/eme/mediafoundation/WMFCDMImpl.cpp |
modified | |
mShutdowndom/media/ipc/MFCDMChild.cpp |
modified | |
ifdom/media/ipc/MFCDMChild.cpp |
modified |
Files Changed
dom/media/eme/mediafoundation/WMFCDMImpl.cppdom/media/ipc/MFCDMChild.cppdom/media/ipc/MFCDMChild.h
Patch
diff --git a/dom/media/eme/mediafoundation/WMFCDMImpl.cpp b/dom/media/eme/mediafoundation/WMFCDMImpl.cpp
index 9491f4c9ec5..7cc9fe4efd8 100644
--- a/dom/media/eme/mediafoundation/WMFCDMImpl.cpp
+++ b/dom/media/eme/mediafoundation/WMFCDMImpl.cpp
@@ -20,6 +20,7 @@ RefPtr<WMFCDMImpl::InitPromise> WMFCDMImpl::Init(
const WMFCDMImpl::InitParams& aParams) {
if (!mCDM) {
mCDM = MakeRefPtr<MFCDMChild>(mKeySystem);
+ mCDM->EnsureRemote();
}
RefPtr<WMFCDMImpl> self = this;
mCDM->Init(aParams.mOrigin, aParams.mInitDataTypes,
@@ -58,6 +59,7 @@ WMFCDMCapabilites::GetCapabilities(
nsTArray<RefPtr<CapabilitiesPromise>> promises;
for (const auto& request : aRequests) {
RefPtr<MFCDMChild> cdm = new MFCDMChild(request.mKeySystem);
+ cdm->EnsureRemote();
promises.AppendElement(cdm->GetCapabilities(MFCDMCapabilitiesRequest{
nsString{request.mKeySystem},
request.mDecryption == KeySystemConfig::DecryptionInfo::Hardware,
diff --git a/dom/media/ipc/MFCDMChild.cpp b/dom/media/ipc/MFCDMChild.cpp
index 9df86b82f47..4cbc7403970 100644
--- a/dom/media/ipc/MFCDMChild.cpp
+++ b/dom/media/ipc/MFCDMChild.cpp
@@ -73,19 +73,25 @@ MFCDMChild::MFCDMChild(const nsAString& aKeySystem)
: mKeySystem(aKeySystem),
mManagerThread(RemoteDecoderManagerChild::GetManagerThread()),
mState(NS_ERROR_NOT_INITIALIZED),
- mShutdown(false) {
- mRemotePromise = EnsureRemote();
-}
+ mShutdown(false) {}
MFCDMChild::~MFCDMChild() {}
-RefPtr<MFCDMChild::RemotePromise> MFCDMChild::EnsureRemote() {
+void MFCDMChild::EnsureRemote() {
+ if (mRemotePromise) {
+ LOG("already created remote promise");
+ return;
+ }
+
if (!mManagerThread) {
LOG("no manager thread");
mState = NS_ERROR_NOT_AVAILABLE;
- return RemotePromise::CreateAndReject(mState, __func__);
+ mRemotePromise = RemotePromise::CreateAndReject(mState, __func__);
+ return;
}
+ mRemotePromise = mRemotePromiseHolder.Ensure(__func__);
+
RefPtr<MFCDMChild> self = this;
RemoteDecoderManagerChild::LaunchUtilityProcessIfNeeded(
RemoteDecodeIn::UtilityProcess_MFMediaEngineCDM)
@@ -115,7 +121,6 @@ RefPtr<MFCDMChild::RemotePromise> MFCDMChild::EnsureRemote() {
mRemotePromiseHolder.RejectIfExists(rv, __func__);
})
->Track(mRemoteRequest);
- return mRemotePromiseHolder.Ensure(__func__);
}
void MFCDMChild::Shutdown() {
diff --git a/dom/media/ipc/MFCDMChild.h b/dom/media/ipc/MFCDMChild.h
index ec766cab248..2f36b9df0d1 100644
--- a/dom/media/ipc/MFCDMChild.h
+++ b/dom/media/ipc/MFCDMChild.h
@@ -85,6 +85,8 @@ class MFCDMChild final : public PMFCDMChild {
mState = NS_ERROR_NOT_AVAILABLE;
}
}
+
+ void EnsureRemote();
void Shutdown();
nsISerialEventTarget* ManagerThread() { return mManagerThread; }
@@ -95,9 +97,6 @@ class MFCDMChild final : public PMFCDMChild {
private:
~MFCDMChild();
- using RemotePromise = GenericNonExclusivePromise;
- RefPtr<RemotePromise> EnsureRemote();
-
void AssertSendable();
const nsString mKeySystem;
@@ -105,6 +104,7 @@ class MFCDMChild final : public PMFCDMChild {
const RefPtr<nsISerialEventTarget> mManagerThread;
RefPtr<MFCDMChild> mIPDLSelfRef;
+ using RemotePromise = GenericNonExclusivePromise;
RefPtr<RemotePromise> mRemotePromise;
MozPromiseHolder<RemotePromise> mRemotePromiseHolder;
MozPromiseRequestHolder<RemotePromise> mRemoteRequest;
Loading diff…
References
On This Page