High firefox Memory Corruption 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionMemory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentWidget
Bug ClassMemory Corruption
Tracker1939063
Fix commit465b5164acd4 (firefox) +8/-6
CISA KEVNot listed
CreditedThe Mozilla Fuzzing Team
Disclosed2025-02-04

Changed Functions

FunctionChangeNotes
if
widget/cocoa/nsChildView.mm
modified
if
widget/nsBaseWidget.cpp
modified

Files Changed

  • widget/android/nsWindow.cpp
  • widget/cocoa/nsChildView.mm
  • widget/gtk/nsWindow.cpp
  • widget/nsBaseWidget.cpp
  • widget/uikit/nsWindow.mm
diff --git a/widget/android/nsWindow.cpp b/widget/android/nsWindow.cpp
index c377529e589..b7211796e42 100644
--- a/widget/android/nsWindow.cpp
+++ b/widget/android/nsWindow.cpp
@@ -2252,8 +2252,6 @@ void nsWindow::Destroy() {
   // Stuff below may release the last ref to this
   nsCOMPtr<nsIWidget> kungFuDeathGrip(this);
 
-  RemoveAllChildren();
-
   // Ensure the compositor has been shutdown before this nsWindow is potentially
   // deleted
   nsBaseWidget::DestroyCompositor();
diff --git a/widget/cocoa/nsChildView.mm b/widget/cocoa/nsChildView.mm
index 5aeacfb2838..e8757f47bf7 100644
--- a/widget/cocoa/nsChildView.mm
+++ b/widget/cocoa/nsChildView.mm
@@ -359,7 +359,9 @@ nsCocoaWindow* nsChildView::GetAppWindowWidget() const {
 void nsChildView::Destroy() {
   NS_OBJC_BEGIN_TRY_IGNORE_BLOCK;
 
-  if (mOnDestroyCalled) return;
+  if (mOnDestroyCalled) {
+    return;
+  }
   mOnDestroyCalled = true;
 
   // Stuff below may delete the last ref to this
diff --git a/widget/gtk/nsWindow.cpp b/widget/gtk/nsWindow.cpp
index 6ac27f3ba16..908e01b8c43 100644
--- a/widget/gtk/nsWindow.cpp
+++ b/widget/gtk/nsWindow.cpp
@@ -564,8 +564,6 @@ void nsWindow::OnDestroy(void) {
   // Remove association between this object and its parent and siblings.
   nsBaseWidget::Destroy();
 
-  RemoveAllChildren();
-
   NotifyWindowDestroyed();
 }
 
diff --git a/widget/nsBaseWidget.cpp b/widget/nsBaseWidget.cpp
index 373f1b7a728..c7ec10d07fc 100644
--- a/widget/nsBaseWidget.cpp
+++ b/widget/nsBaseWidget.cpp
@@ -538,8 +538,10 @@ void nsBaseWidget::Destroy() {
   // disconnect from the parent
   if (mParent) {
     mParent->RemoveFromChildList(this);
+    mParent = nullptr;
   }
-  mParent = nullptr;
+  // disconnect from the children
+  RemoveAllChildren();
 }
 
 nsIWidget* nsIWidget::GetTopLevelWidget() {
diff --git a/widget/uikit/nsWindow.mm b/widget/uikit/nsWindow.mm
index 9e0055c893e..a62653dc165 100644
--- a/widget/uikit/nsWindow.mm
+++ b/widget/uikit/nsWindow.mm
@@ -772,6 +772,8 @@ void nsWindow::Destroy() {
 
   [mNativeView widgetDestroyed];
 
+  nsCOMPtr<nsIWidget> kungFuDeathGrip(this);
+
   nsBaseWidget::Destroy();
 
   // ReportDestroyEvent();
Loading diff…