Firefox · DOM
CVE-2026-117943
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
OnStartRequestdom/html/ImageDocument.cpp |
modified | |
ifdom/html/ImageDocument.cpp |
modified | |
OnStartRequestdom/html/MediaDocument.cpp |
modified | |
ifdom/html/MediaDocument.cpp |
modified |
Files Changed
dom/html/ImageDocument.cppdom/html/MediaDocument.cpp
Patch
diff --git a/dom/html/ImageDocument.cpp b/dom/html/ImageDocument.cpp
index bfebbc75f40..46adb9af10b 100644
--- a/dom/html/ImageDocument.cpp
+++ b/dom/html/ImageDocument.cpp
@@ -66,9 +66,9 @@ ImageListener::~ImageListener() = default;
NS_IMETHODIMP
ImageListener::OnStartRequest(nsIRequest* request) {
- NS_ENSURE_TRUE(mDocument, NS_ERROR_FAILURE);
+ RefPtr<ImageDocument> imgDoc = static_cast<ImageDocument*>(mDocument.get());
+ NS_ENSURE_TRUE(imgDoc, NS_ERROR_FAILURE);
- ImageDocument* imgDoc = static_cast<ImageDocument*>(mDocument.get());
nsCOMPtr<nsIChannel> channel = do_QueryInterface(request);
if (!channel) {
return NS_ERROR_FAILURE;
diff --git a/dom/html/MediaDocument.cpp b/dom/html/MediaDocument.cpp
index 990e7de4895..5e29d6863e6 100644
--- a/dom/html/MediaDocument.cpp
+++ b/dom/html/MediaDocument.cpp
@@ -41,9 +41,10 @@ NS_IMPL_ISUPPORTS(MediaDocumentStreamListener, nsIRequestObserver,
NS_IMETHODIMP
MediaDocumentStreamListener::OnStartRequest(nsIRequest* request) {
- NS_ENSURE_TRUE(mDocument, NS_ERROR_FAILURE);
+ RefPtr<MediaDocument> document = mDocument;
+ NS_ENSURE_TRUE(document, NS_ERROR_FAILURE);
- mDocument->StartLayout();
+ document->StartLayout();
if (nsCOMPtr<nsIStreamListener> nextStream = mNextStream) {
return nextStream->OnStartRequest(request);
Loading diff…
References
On This Page