High firefox Memory Corruption 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionMemory safety bugs present in Firefox 139 and Thunderbird 139. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentWidget
Bug ClassMemory Corruption
Tracker1941377
Fix commitfd96a33ebf60 (firefox) +19/-5
CISA KEVNot listed
CreditedAndrew McCreight, Gabriele Svelto, Beth Rennie (she/her), Steven Michaud, the Mozilla Fuzzing Team
Disclosed2025-06-24

Changed Functions

FunctionChangeNotes
if
widget/gtk/DMABufSurface.cpp
modified

Files Changed

  • widget/gtk/DMABufSurface.cpp
  • widget/gtk/DMABufSurface.h
diff --git a/widget/gtk/DMABufSurface.cpp b/widget/gtk/DMABufSurface.cpp
index 3523902cd43..6a81a76cd19 100644
--- a/widget/gtk/DMABufSurface.cpp
+++ b/widget/gtk/DMABufSurface.cpp
@@ -229,7 +229,8 @@ nsAutoCString DMABufSurface::GetDebugTag() const {
   tag.AppendPrintf("[%p]", this);
   return tag;
 }
-bool DMABufSurface::IsGlobalRefSet() const {
+bool DMABufSurface::IsGlobalRefSet() {
+  MutexAutoLock lock(mSurfaceLock);
   if (!mGlobalRefCountFd) {
     return false;
   }
@@ -241,6 +242,7 @@ bool DMABufSurface::IsGlobalRefSet() const {
 
 void DMABufSurface::GlobalRefRelease() {
 #ifdef HAVE_EVENTFD
+  MutexAutoLock lock(mSurfaceLock);
   if (!mGlobalRefCountFd) {
     return;
   }
@@ -262,9 +264,9 @@ void DMABufSurface::GlobalRefRelease() {
 #endif
 }
 
-void DMABufSurface::GlobalRefAdd() {
+void DMABufSurface::GlobalRefAddLocked(const MutexAutoLock& aProofOfLock) {
 #ifdef HAVE_EVENTFD
-  LOGDMABUFREF("DMABufSurface::GlobalRefAdd UID %d", mUID);
+  LOGDMABUFREF("DMABufSurface::GlobalRefAddLocked UID %d", mUID);
   MOZ_DIAGNOSTIC_ASSERT(mGlobalRefCountFd);
   uint64_t counter = 1;
   if (write(mGlobalRefCountFd, &counter, sizeof(counter)) != sizeof(counter)) {
@@ -275,9 +277,16 @@ void DMABufSurface::GlobalRefAdd() {
 #endif
 }
 
+void DMABufSurface::GlobalRefAdd() {
+  LOGDMABUFREF("DMABufSurface::GlobalRefAdd UID %d", mUID);
+  MutexAutoLock lock(mSurfaceLock);
+  GlobalRefAddLocked(lock);
+}
+
 void DMABufSurface::GlobalRefCountCreate() {
 #ifdef HAVE_EVENTFD
   LOGDMABUFREF("DMABufSurface::GlobalRefCountCreate UID %d", mUID);
+  MutexAutoLock lock(mSurfaceLock);
   MOZ_DIAGNOSTIC_ASSERT(!mGlobalRefCountFd);
   // Create global ref count initialized to 0,
   // i.e. is not referenced after create.
@@ -294,15 +303,17 @@ void DMABufSurface::GlobalRefCountCreate() {
 
 void DMABufSurface::GlobalRefCountImport(int aFd) {
 #ifdef HAVE_EVENTFD
+  MutexAutoLock lock(mSurfaceLock);
   mGlobalRefCountFd = aFd;
   if (mGlobalRefCountFd) {
     LOGDMABUFREF("DMABufSurface::GlobalRefCountImport UID %d", mUID);
-    GlobalRefAdd();
+    GlobalRefAddLocked(lock);
   }
 #endif
 }
 
 int DMABufSurface::GlobalRefCountExport() {
+  MutexAutoLock lock(mSurfaceLock);
 #ifdef MOZ_LOGGING
   if (mGlobalRefCountFd) {
     LOGDMABUFREF("DMABufSurface::GlobalRefCountExport UID %d", mUID);
@@ -312,6 +323,7 @@ int DMABufSurface::GlobalRefCountExport() {
 }
 
 void DMABufSurface::GlobalRefCountDelete() {
+  MutexAutoLock lock(mSurfaceLock);
   if (mGlobalRefCountFd) {
     LOGDMABUFREF("DMABufSurface::GlobalRefCountDelete UID %d", mUID);
     close(mGlobalRefCountFd);
diff --git a/widget/gtk/DMABufSurface.h b/widget/gtk/DMABufSurface.h
index 293d824f422..fb867a4576a 100644
--- a/widget/gtk/DMABufSurface.h
+++ b/widget/gtk/DMABufSurface.h
@@ -179,10 +179,12 @@ class DMABufSurface {
 
   // If global reference counter was created by GlobalRefCountCreate()
   // returns true when there's an active surface reference.
-  bool IsGlobalRefSet() const;
+  bool IsGlobalRefSet();
 
   // Add/Remove additional reference to the surface global reference counter.
   void GlobalRefAdd();
+  void GlobalRefAddLocked(const mozilla::MutexAutoLock& aProofOfLock);
+
   void GlobalRefRelease();
 
   static void DeleteSnapshotGLContext();
Loading diff…