Medium firefox Memory Corruption 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionMemory safety bugs present in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145 and Thunderbird 145. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentNetworking
Bug ClassMemory Corruption
Tracker1966501
Fix commitcec17b64a170 (firefox) +25/-1
CISA KEVNot listed
CreditedMaurice Dauer and the Mozilla Fuzzing Team
Disclosed2025-12-09

Changed Functions

FunctionChangeNotes
if
netwerk/protocol/http/Http3Session.cpp
modified
while
netwerk/protocol/http/Http3Session.cpp
modified
for
netwerk/protocol/http/HttpConnectionUDP.cpp
modified

Files Changed

  • netwerk/base/nsIUDPSocket.idl
  • netwerk/base/nsUDPSocket.cpp
  • netwerk/protocol/http/Http3ConnectUDPStream.cpp
  • netwerk/protocol/http/Http3Session.cpp
  • netwerk/protocol/http/HttpConnectionUDP.cpp
diff --git a/netwerk/base/nsIUDPSocket.idl b/netwerk/base/nsIUDPSocket.idl
index 7063f6e4b39..00f8b9a328c 100644
--- a/netwerk/base/nsIUDPSocket.idl
+++ b/netwerk/base/nsIUDPSocket.idl
@@ -273,6 +273,13 @@ interface nsIUDPSocket : nsISupports
       */
     [noscript, notxpcom] void enableWritePoll();
 
+     /**
+      * isSocketClosed
+      *
+      * @return true when the socket is already closed.
+      */
+    [noscript, notxpcom] boolean isSocketClosed();
+
     /**
      * addOutputBytes
      *
diff --git a/netwerk/base/nsUDPSocket.cpp b/netwerk/base/nsUDPSocket.cpp
index 01320b6f183..d6b3e40acbd 100644
--- a/netwerk/base/nsUDPSocket.cpp
+++ b/netwerk/base/nsUDPSocket.cpp
@@ -1222,6 +1222,8 @@ void nsUDPSocket::EnableWritePoll() {
   mPollFlags = (PR_POLL_WRITE | PR_POLL_READ | PR_POLL_EXCEPT);
 }
 
+bool nsUDPSocket::IsSocketClosed() { return !!mFD; }
+
 NS_IMETHODIMP
 nsUDPSocket::SendBinaryStream(const nsACString& aHost, uint16_t aPort,
                               nsIInputStream* aStream) {
diff --git a/netwerk/protocol/http/Http3ConnectUDPStream.cpp b/netwerk/protocol/http/Http3ConnectUDPStream.cpp
index 5c4b433ad5d..09204741b61 100644
--- a/netwerk/protocol/http/Http3ConnectUDPStream.cpp
+++ b/netwerk/protocol/http/Http3ConnectUDPStream.cpp
@@ -266,6 +266,8 @@ int64_t Http3ConnectUDPStream::GetFileDescriptor() { return -1; }
 
 void Http3ConnectUDPStream::EnableWritePoll() {}
 
+bool Http3ConnectUDPStream::IsSocketClosed() { return mSendState == SEND_DONE; }
+
 void Http3ConnectUDPStream::AddOutputBytes(uint32_t aBytes) {}
 
 void Http3ConnectUDPStream::AddInputBytes(uint32_t aBytes) {}
diff --git a/netwerk/protocol/http/Http3Session.cpp b/netwerk/protocol/http/Http3Session.cpp
index c54a5c05a0c..7adfc143088 100644
--- a/netwerk/protocol/http/Http3Session.cpp
+++ b/netwerk/protocol/http/Http3Session.cpp
@@ -439,6 +439,11 @@ nsresult Http3Session::ProcessInput(nsIUDPSocket* socket) {
   LOG(("Http3Session::ProcessInput writer=%p [this=%p state=%d]",
        mUdpConn.get(), this, mState));
 
+  if (!socket || socket->IsSocketClosed()) {
+    MOZ_DIAGNOSTIC_ASSERT(false, "UDP socket should still be open");
+    return NS_ERROR_UNEXPECTED;
+  }
+
   if (mUseNSPRForIO) {
     while (true) {
       nsTArray<uint8_t> data;
@@ -1091,6 +1096,11 @@ nsresult Http3Session::ProcessOutput(nsIUDPSocket* socket) {
   LOG(("Http3Session::ProcessOutput reader=%p, [this=%p]", mUdpConn.get(),
        this));
 
+  if (!socket || socket->IsSocketClosed()) {
+    MOZ_DIAGNOSTIC_ASSERT(false, "UDP socket should still be open");
+    return NS_ERROR_UNEXPECTED;
+  }
+
   if (mUseNSPRForIO) {
     mSocket = socket;
     nsresult rv = mHttp3Connection->ProcessOutputAndSendUseNSPRForIO(
diff --git a/netwerk/protocol/http/HttpConnectionUDP.cpp b/netwerk/protocol/http/HttpConnectionUDP.cpp
index 08bc08ec288..9db11768d2c 100644
--- a/netwerk/protocol/http/HttpConnectionUDP.cpp
+++ b/netwerk/protocol/http/HttpConnectionUDP.cpp
@@ -619,6 +619,9 @@ void HttpConnectionUDP::Close(nsresult reason, bool aIsShutdown) {
     socket->Close();
   }
 
+  MOZ_DIAGNOSTIC_ASSERT(!mHttp3Session || mHttp3Session->IsClosed(),
+                        "Http3Session should already be closed");
+
   for (const auto& trans : mQueuedHttpConnectTransaction) {
     trans->Close(reason);
   }
@@ -718,7 +721,7 @@ nsresult HttpConnectionUDP::OnHeadersAvailable(nsAHttpTransaction* trans,
     // response headers so that it will be ready to receive the new response.
     if (mIsReused &&
         ((PR_IntervalNow() - mHttp3Session->LastWriteTime()) < k1000ms)) {
-      Close(NS_ERROR_NET_RESET);
+      CloseTransaction(mHttp3Session, NS_ERROR_NET_RESET);
       *reset = true;
       return NS_OK;
     }
Loading diff…