Firefox · DOM
CVE-2026-109741
Logic Error in DOM
Overview
Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/fs/parent/datamodel/FileSystemDatabaseManagerVersion002.cpp |
modified |
Files Changed
dom/fs/parent/FileSystemHashSource.cppdom/fs/parent/datamodel/FileSystemDatabaseManagerVersion002.cpp
Patch
diff --git a/dom/fs/parent/FileSystemHashSource.cpp b/dom/fs/parent/FileSystemHashSource.cpp
index c9d0f0b1230..58a7ecb8529 100644
--- a/dom/fs/parent/FileSystemHashSource.cpp
+++ b/dom/fs/parent/FileSystemHashSource.cpp
@@ -44,6 +44,8 @@ Result<EntryId, QMResult> FileSystemHashSource::GenerateHash(
Result<Name, QMResult> FileSystemHashSource::EncodeHash(const FileId& aFileId) {
MOZ_ASSERT(32u == aFileId.Value().Length());
+ QM_TRY(OkIf(32u == aFileId.Value().Length()),
+ Err(QMResult(NS_ERROR_DOM_NOT_FOUND_ERR)));
nsCString encoded;
base32encode(&aFileId.Value(), &encoded);
diff --git a/dom/fs/parent/datamodel/FileSystemDatabaseManagerVersion002.cpp b/dom/fs/parent/datamodel/FileSystemDatabaseManagerVersion002.cpp
index 8ac63a157f1..e638497cba4 100644
--- a/dom/fs/parent/datamodel/FileSystemDatabaseManagerVersion002.cpp
+++ b/dom/fs/parent/datamodel/FileSystemDatabaseManagerVersion002.cpp
@@ -42,7 +42,7 @@ Result<FileId, QMResult> GetFileId002(const FileSystemConnection& aConnection,
QM_TRY(QM_TO_RESULT(stmt.BindEntryIdByName("entryId"_ns, aEntryId)));
QM_TRY_UNWRAP(bool moreResults, stmt.ExecuteStep());
- if (!moreResults) {
+ if (!moreResults || stmt.IsNullByColumn(/* Column */ 0u)) {
return Err(QMResult(NS_ERROR_DOM_NOT_FOUND_ERR));
}
@@ -94,7 +94,11 @@ nsresult RehashFile(const FileSystemConnection& aConnection,
: insertNewFileAndTypeQuery;
const nsLiteralCString updateFileMappingsQuery =
- "UPDATE FileIds SET handle = :newId WHERE handle = :handle ;"_ns;
+ "UPDATE FileIds SET handle = :newId "
+ "FROM MainFiles WHERE MainFiles.handle = :handle "
+ "AND FileIds.fileId = MainFiles.fileId "
+ "AND FileIds.handle = :handle "
+ ";"_ns;
const nsLiteralCString updateMainFilesQuery =
"UPDATE MainFiles SET handle = :newId WHERE handle = :handle ;"_ns;
@@ -203,14 +207,14 @@ nsresult RehashDirectory(const FileSystemConnection& aConnection,
const nsLiteralCString updateFileMappingsQuery =
"UPDATE FileIds "
- "SET handle = CASE WHEN replacement.isMain IS NULL THEN NULL "
- "ELSE replacement.hash END "
+ "SET handle = replacement.hash "
"FROM ( SELECT ParentChildHash.handle AS handle, "
"ParentChildHash.hash AS hash, "
- "MainFiles.handle AS isMain "
- "FROM ParentChildHash LEFT JOIN MainFiles "
+ "MainFiles.fileId AS mainFileId "
+ "FROM ParentChildHash INNER JOIN MainFiles "
"ON ParentChildHash.handle = MainFiles.handle ) AS replacement "
"WHERE FileIds.handle = replacement.handle "
+ "AND FileIds.fileId = replacement.mainFileId "
";"_ns;
const nsLiteralCString updateMainFilesQuery =
@@ -665,6 +669,7 @@ Result<FileId, QMResult> FileSystemDatabaseManagerVersion002::EnsureFileId(
})));
if (maybeMainFileId) {
+ MOZ_ASSERT(!maybeMainFileId->IsEmpty());
return *maybeMainFileId;
}
Loading diff…
References
On This Page