Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionSandbox escape due to incorrect boundary conditions in the XPCOM component
ComponentCore
Bug ClassLogic Error
Tracker2071069
Fix commit9b473c3cc2b1 (firefox) +1/-2
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-29

Files Changed

  • xpcom/io/nsStorageStream.cpp
diff --git a/xpcom/io/nsStorageStream.cpp b/xpcom/io/nsStorageStream.cpp
index 7d465ffd503..273b34dfaa6 100644
--- a/xpcom/io/nsStorageStream.cpp
+++ b/xpcom/io/nsStorageStream.cpp
@@ -171,11 +171,10 @@ nsStorageStream::Write(const char* aBuffer, uint32_t aCount,
   LOG(("nsStorageStream [%p] Write mWriteCursor=%p mSegmentEnd=%p aCount=%d\n",
        this, mWriteCursor, mSegmentEnd, aCount));
 
+  aCount = std::min(aCount, mMaxLogicalLength - mLogicalLength);
   uint32_t remaining = aCount;
   const char* readCursor = aBuffer;
 
-  remaining = std::min(remaining, mMaxLogicalLength - mLogicalLength);
-
   auto onExit = mozilla::MakeScopeExit([&] {
     mMutex.AssertCurrentThreadOwns();
     *aNumWritten = aCount - remaining;
Loading diff…