Medium firefox UAF 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionA race during concurrent delazification could have led to a use-after-free.
ComponentSpiderMonkey
Bug ClassUAF
Tracker1939710
Fix commitf2115f8f412c (firefox) +8/-4
CISA KEVNot listed
CreditedNils Bars
Disclosed2025-02-04

Changed Functions

FunctionChangeNotes
if
js/src/vm/JSScript.cpp
modified

Files Changed

  • js/src/vm/JSScript.cpp
diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
index 84e1f6298ab..75551c72a92 100644
--- a/js/src/vm/JSScript.cpp
+++ b/js/src/vm/JSScript.cpp
@@ -1255,9 +1255,11 @@ ScriptSource::PinnedUnits<Unit>::PinnedUnits(
     : PinnedUnitsBase(source) {
   MOZ_ASSERT(source->hasSourceType<Unit>(), "must pin units of source's type");
 
+  addReader();
+
   units_ = source->units<Unit>(cx, holder, begin, len);
-  if (units_) {
-    addReader();
+  if (!units_) {
+    removeReader<Unit>();
   }
 }
 
@@ -1270,9 +1272,11 @@ ScriptSource::PinnedUnitsIfUncompressed<Unit>::PinnedUnitsIfUncompressed(
     : PinnedUnitsBase(source) {
   MOZ_ASSERT(source->hasSourceType<Unit>(), "must pin units of source's type");
 
+  addReader();
+
   units_ = source->uncompressedUnits<Unit>(begin, len);
-  if (units_) {
-    addReader();
+  if (!units_) {
+    removeReader<Unit>();
   }
 }
 
Loading diff…