Firefox · DOM
CVE-2026-117892
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp |
modified |
Files Changed
dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp
Patch
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp
index 494519a2fe8..755e87d6cc3 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp
@@ -221,8 +221,6 @@ static void nr_ice_candidate_pair_stun_cb(NR_SOCKET s, int how, void *cb_arg)
nr_transport_addr response_dst;
nr_stun_message_attribute *attr;
- pair->stun_cb_timer=0;
-
r_log(LOG_ICE,LOG_DEBUG,"ICE-PEER(%s)/STREAM(%s)/CAND-PAIR(%s): STUN cb on pair addr = %s",
pair->pctx->label,pair->local->stream->label,pair->codeword,pair->as_string);
@@ -413,6 +411,14 @@ static void nr_ice_candidate_pair_stun_cb(NR_SOCKET s, int how, void *cb_arg)
return;
}
+static void nr_ice_candidate_pair_stun_timer_cb(NR_SOCKET s, int how, void *cb_arg)
+ {
+ nr_ice_cand_pair *pair=(nr_ice_cand_pair*)cb_arg;
+
+ pair->stun_cb_timer=0;
+ nr_ice_candidate_pair_stun_cb(s,how,cb_arg);
+ }
+
static void nr_ice_candidate_pair_restart(nr_ice_peer_ctx *pctx, nr_ice_cand_pair *pair)
{
int r,_status;
@@ -442,8 +448,9 @@ static void nr_ice_candidate_pair_restart(nr_ice_peer_ctx *pctx, nr_ice_cand_pai
abort:
if(_status){
/* Don't fire the CB, but schedule it to fire ASAP */
- assert(!pair->stun_cb_timer);
- NR_ASYNC_TIMER_SET(0,nr_ice_candidate_pair_stun_cb,pair, &pair->stun_cb_timer);
+ NR_async_timer_cancel(pair->stun_cb_timer);
+ pair->stun_cb_timer=0;
+ NR_ASYNC_TIMER_SET(0,nr_ice_candidate_pair_stun_timer_cb,pair, &pair->stun_cb_timer);
_status=0;
}
}
Loading diff…
References
On This Page