Firefox · DOM
CVE-2026-0882
UAF in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
docshell/base/ChildProcessChannelListener.hdom/webtransport/parent/WebTransportParent.htoolkit/components/glean/bindings/private/Ping.cppxpcom/ds/nsTHashtable.h
Patch
diff --git a/docshell/base/ChildProcessChannelListener.h b/docshell/base/ChildProcessChannelListener.h
index c00c2ff5a72..30bdc8c7223 100644
--- a/docshell/base/ChildProcessChannelListener.h
+++ b/docshell/base/ChildProcessChannelListener.h
@@ -45,8 +45,8 @@ class ChildProcessChannelListener final {
};
// TODO Backtrack.
- nsTHashMap<nsUint64HashKey, Callback> mCallbacks;
- nsTHashMap<nsUint64HashKey, CallbackArgs> mChannelArgs;
+ nsTHashMap<NoMemMoveKey<nsUint64HashKey>, Callback> mCallbacks;
+ nsTHashMap<NoMemMoveKey<nsUint64HashKey>, CallbackArgs> mChannelArgs;
};
} // namespace mozilla::dom
diff --git a/dom/webtransport/parent/WebTransportParent.h b/dom/webtransport/parent/WebTransportParent.h
index 89b575f5b9d..fc5f30a8b60 100644
--- a/dom/webtransport/parent/WebTransportParent.h
+++ b/dom/webtransport/parent/WebTransportParent.h
@@ -103,9 +103,11 @@ class WebTransportParent : public PWebTransportParent,
OnResetOrStopSendingCallback mCallback;
nsCOMPtr<T> mStream;
};
- nsTHashMap<nsUint64HashKey, StreamHash<nsIWebTransportBidirectionalStream>>
+ nsTHashMap<NoMemMoveKey<nsUint64HashKey>,
+ StreamHash<nsIWebTransportBidirectionalStream>>
mBidiStreamCallbackMap;
- nsTHashMap<nsUint64HashKey, StreamHash<nsIWebTransportSendStream>>
+ nsTHashMap<NoMemMoveKey<nsUint64HashKey>,
+ StreamHash<nsIWebTransportSendStream>>
mUniStreamCallbackMap;
};
diff --git a/toolkit/components/glean/bindings/private/Ping.cpp b/toolkit/components/glean/bindings/private/Ping.cpp
index a2374944653..9bac6cbf955 100644
--- a/toolkit/components/glean/bindings/private/Ping.cpp
+++ b/toolkit/components/glean/bindings/private/Ping.cpp
@@ -23,7 +23,8 @@ namespace mozilla::glean {
namespace impl {
-using CallbackMapType = nsTHashMap<uint32_t, FalliblePingTestCallback>;
+using CallbackMapType =
+ nsTHashMap<NoMemMoveKey<nsUint32HashKey>, FalliblePingTestCallback>;
using MetricIdToCallbackMutex = StaticDataMutex<UniquePtr<CallbackMapType>>;
static Maybe<MetricIdToCallbackMutex::AutoLock> GetCallbackMapLock() {
static MetricIdToCallbackMutex sCallbacks("sCallbacks");
diff --git a/xpcom/ds/nsTHashtable.h b/xpcom/ds/nsTHashtable.h
index 8a557764b1a..51117b30547 100644
--- a/xpcom/ds/nsTHashtable.h
+++ b/xpcom/ds/nsTHashtable.h
@@ -650,6 +650,15 @@ static void FixedSizeEntryMover(PLDHashTable*, const PLDHashEntryHdr* aFrom,
memcpy(aTo, aFrom, N);
}
+// Helper type which wraps the access to EntryType::ALLOW_MEMMOVE. This is done
+// to ensure that the MOZ_NEEDS_MEMMOVABLE_TYPE attribute is applied to the
+// entry if we're going to use FixedSizeEntryMover, performing extra
+// compile-time checks against the use of non-memmoveable types.
+template <class EntryType, bool = EntryType::ALLOW_MEMMOVE>
+struct MOZ_NEEDS_MEMMOVABLE_TYPE CheckAllowMemmove : std::true_type {};
+template <class EntryType>
+struct CheckAllowMemmove<EntryType, false> : std::false_type {};
+
} // namespace detail
} // namespace mozilla
@@ -675,7 +684,9 @@ template <class EntryType>
// function avoids that problem.
static const PLDHashTableOps sOps = {
s_HashKey, s_MatchEntry,
- EntryType::ALLOW_MEMMOVE
+ // We intentionally indirect the access of ALLOW_MEMMOVE through
+ // CheckAllowMemmove to perform some additional static analysis.
+ mozilla::detail::CheckAllowMemmove<EntryType>::value
? mozilla::detail::FixedSizeEntryMover<sizeof(EntryType)>
: s_CopyEntry,
// Simplify hashtable clearing in case our entries are trivially
Loading diff…
References
On This Page