High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in MediaTrackGraphImpl::GetInstance()
ComponentDOM
Bug ClassUAF
Tracker1988931
Fix commitfe6c46f32891 (firefox) +8/-8
CISA KEVNot listed
CreditedIrvan Kurniawan
Disclosed2025-10-14

Changed Functions

FunctionChangeNotes
if
dom/media/MediaTrackGraph.cpp
modified

Files Changed

  • dom/media/MediaTrackGraph.cpp
diff --git a/dom/media/MediaTrackGraph.cpp b/dom/media/MediaTrackGraph.cpp
index 26c396a6ef2..6d7d4e78ae8 100644
--- a/dom/media/MediaTrackGraph.cpp
+++ b/dom/media/MediaTrackGraph.cpp
@@ -3574,11 +3574,10 @@ MediaTrackGraphImpl* MediaTrackGraphImpl::GetInstance(
   MOZ_ASSERT(aGraphDriverRequested != OFFLINE_THREAD_DRIVER,
              "Use CreateNonRealtimeInstance() for offline graphs");
 
-  GraphHashSet* graphs = Graphs();
-  GraphHashSet::AddPtr addPtr =
-      graphs->lookupForAdd({aWindowID, aSampleRate, aPrimaryOutputDeviceID});
-  if (addPtr) {  // graph already exists
-    return *addPtr;
+  MediaTrackGraphImpl* graph =
+      GetInstanceIfExists(aWindowID, aSampleRate, aPrimaryOutputDeviceID);
+  if (graph) {  // graph already exists
+    return graph;
   }
 
   GraphRunType runType = DIRECT_DRIVER;
@@ -3589,10 +3588,11 @@ MediaTrackGraphImpl* MediaTrackGraphImpl::GetInstance(
   // In a real time graph, the number of output channels is determined by
   // the underlying number of channel of the default audio output device.
   uint32_t channelCount = CubebUtils::MaxNumberOfChannels();
-  MediaTrackGraphImpl* graph = new MediaTrackGraphImpl(
-      aWindowID, aSampleRate, aPrimaryOutputDeviceID, aMainThread);
+  graph = new MediaTrackGraphImpl(aWindowID, aSampleRate,
+                                  aPrimaryOutputDeviceID, aMainThread);
   graph->Init(aGraphDriverRequested, runType, channelCount);
-  MOZ_ALWAYS_TRUE(graphs->add(addPtr, graph));
+  MOZ_ALWAYS_TRUE(Graphs()->putNew(
+      {aWindowID, aSampleRate, aPrimaryOutputDeviceID}, graph));
 
   LOG(LogLevel::Debug, ("Starting up MediaTrackGraph %p for window 0x%" PRIx64,
                         graph, aWindowID));
Loading diff…