Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionDenial-of-service in the Storage: StorageManager component
ComponentDOM
Bug ClassLogic Error
Tracker2059222
Fix commit2452225f5a02 (firefox) +9/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-29

Files Changed

  • dom/simpledb/ActorsParent.cpp
diff --git a/dom/simpledb/ActorsParent.cpp b/dom/simpledb/ActorsParent.cpp
index cdfcf1b11f4..8eadc981952 100644
--- a/dom/simpledb/ActorsParent.cpp
+++ b/dom/simpledb/ActorsParent.cpp
@@ -777,6 +777,15 @@ bool Connection::VerifyRequestParams(const SDBRequestParams& aParams) const {
 
   switch (aParams.type()) {
     case SDBRequestParams::TSDBRequestOpenParams: {
+      const auto& name = aParams.get_SDBRequestOpenParams().name();
+
+      // The name becomes part of a path passed to NUL-terminated OS APIs.
+      // Reject embedded NULs before they can truncate the on-disk leaf name.
+      if (NS_WARN_IF(name.Contains(u'\0'))) {
+        MOZ_CRASH_UNLESS_FUZZING();
+        return false;
+      }
+
       if (NS_WARN_IF(mOpen)) {
         MOZ_CRASH_UNLESS_FUZZING();
         return false;
Loading diff…