PatchGap
Firefox · SpiderMonkey

CVE-2025-1942

Uninitialized Memory in SpiderMonkey
Medium firefox Uninitialized Memory 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionWhen String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string
ComponentSpiderMonkey
Bug ClassUninitialized Memory
Tracker1947139
Fix commitf3ce96184239 (firefox) +1/-1
CISA KEVNot listed
Creditedanbu
Disclosed2025-03-04

Changed Functions

FunctionChangeNotes
if
js/src/vm/StringType.cpp
 modified

Files Changed

  • js/src/vm/StringType.cpp

Patch

view commit
diff --git a/js/src/vm/StringType.cpp b/js/src/vm/StringType.cpp
index 2bff1d4aa4b..f368399b875 100644
--- a/js/src/vm/StringType.cpp
+++ b/js/src/vm/StringType.cpp
@@ -2894,7 +2894,7 @@ bool js::StringChars<CharT>::maybeRealloc(JSContext* cx, size_t oldLength,
     if (!chars) {
       return false;
     }
-    std::memcpy(chars.data(), inlineChars_, InlineLength);
+    std::memcpy(chars.data(), inlineChars_, InlineLength * sizeof(CharT));
 
     ownedChars_.set(std::move(chars));
     return true;
Loading diff…
On This Page