High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionIncorrect boundary conditions in the JavaScript Engine component
ComponentSpiderMonkey
Bug ClassLogic Error
Tracker2082092
Fix commit313233d1c3f1 (firefox) +10/-4
CISA KEVNot listed
CreditedOpenAI Codex Security (kylebot)
Disclosed2026-10-27

Changed Functions

FunctionChangeNotes
if
js/src/irregexp/RegExpAPI.cpp
modified

Files Changed

  • js/src/irregexp/RegExpAPI.cpp
diff --git a/js/src/irregexp/RegExpAPI.cpp b/js/src/irregexp/RegExpAPI.cpp
index cb0f70e1113..a42e53cf2f9 100644
--- a/js/src/irregexp/RegExpAPI.cpp
+++ b/js/src/irregexp/RegExpAPI.cpp
@@ -303,14 +303,20 @@ static void ReportSyntaxError(TokenStreamAnyChars& ts,
 template <typename CharT>
 static bool CheckPatternSyntaxImpl(js::LifoAlloc& alloc,
                                    JS::NativeStackLimit stackLimit,
-                                   const CharT* input, uint32_t inputLength,
+                                   const CharT* input, size_t inputLength,
                                    JS::RegExpFlags flags,
                                    RegExpCompileData* result,
                                    JS::AutoAssertNoGC& nogc) {
   Zone zone(&alloc);
-
-  return RegExpParser::VerifyRegExpSyntax(&zone, stackLimit, input, inputLength,
-                                          flags, result, nogc);
+  static_assert(JSString::MAX_LENGTH < INT_MAX);
+  if (inputLength > JSString::MAX_LENGTH) {
+    result->error = RegExpError::kTooLarge;
+    result->error_pos = 0;
+    return false;
+  }
+  return RegExpParser::VerifyRegExpSyntax(&zone, stackLimit, input,
+                                          AssertedCast<int>(inputLength), flags,
+                                          result, nogc);
 }
 
 bool CheckPatternSyntax(js::LifoAlloc& alloc, JS::NativeStackLimit stackLimit,
Loading diff…