Firefox · DOM
CVE-2026-117903
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/media/ChannelMediaResource.cpp |
modified | |
fordom/media/ChannelMediaResource.cpp |
modified |
Files Changed
dom/media/ChannelMediaResource.cpp
Patch
diff --git a/dom/media/ChannelMediaResource.cpp b/dom/media/ChannelMediaResource.cpp
index 713e845c693..a816597eadf 100644
--- a/dom/media/ChannelMediaResource.cpp
+++ b/dom/media/ChannelMediaResource.cpp
@@ -161,7 +161,7 @@ nsresult ChannelMediaResource::OnStartRequest(nsIRequest* aRequest,
MediaDecoderOwner* owner = mCallback->GetMediaOwner();
MOZ_DIAGNOSTIC_ASSERT(owner);
- dom::HTMLMediaElement* element = owner->GetMediaElement();
+ RefPtr<dom::HTMLMediaElement> element = owner->GetMediaElement();
MOZ_DIAGNOSTIC_ASSERT(element);
nsresult status;
@@ -307,12 +307,17 @@ nsresult ChannelMediaResource::OnStartRequest(nsIRequest* aRequest,
// Update principals before OnDataAvailable() putting the data in the cache.
// This is important, we want to make sure all principals are updated before
// any consumer can see the new data.
+ nsCOMPtr<nsIChannel> originalChannel = mChannel;
UpdatePrincipal();
- if (owner->HasError()) {
+ if (element->HasError()) {
// Updating the principal resulted in an error. Abort the load.
CloseChannel();
return NS_OK;
}
+ if (mChannel != originalChannel) {
+ LOG("Channel closed or replaced while updating the principal");
+ return NS_OK;
+ }
mCacheStream.NotifyDataStarted(mLoadID, startOffset, seekable, length);
mIsTransportSeekable = seekable;
@@ -323,7 +328,7 @@ nsresult ChannelMediaResource::OnStartRequest(nsIRequest* aRequest,
mSuspendAgent.Delegate(mChannel);
// Fires an initial progress event.
- owner->DownloadProgressed();
+ element->DownloadProgressed();
nsCOMPtr<nsIThreadRetargetableRequest> retarget;
if ((retarget = do_QueryInterface(aRequest))) {
@@ -892,10 +897,12 @@ void ChannelMediaResource::UpdatePrincipal() {
getter_AddRefs(principal));
if (nsContentUtils::CombineResourcePrincipals(&mSharedInfo->mPrincipal,
principal)) {
+ nsCOMPtr<nsIChannel> originalChannel = mChannel;
for (auto* r : mSharedInfo->mResources) {
r->CacheClientNotifyPrincipalChanged();
}
- if (!mChannel) { // Sometimes cleared during NotifyPrincipalChanged()
+ // Sometimes cleared or replaced during CacheClientNotifyPrincipalChanged().
+ if (mChannel != originalChannel) {
return;
}
}
Loading diff…
References
On This Page