Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionCryptographic issue in the WebRTC: Networking component
ComponentDOM
Bug ClassLogic Error
Tracker2061508
Fix commit0f6f9f348688 (firefox) +1/-147
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-27

Changed Functions

FunctionChangeNotes
if
dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_proc.cpp
modified

Files Changed

  • dom/media/webrtc/transport/third_party/nICEr/nicer.gyp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/stun.h
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.h
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.h
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_codec.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_hint.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.h
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_proc.cpp
diff --git a/dom/media/webrtc/transport/third_party/nICEr/nicer.gyp b/dom/media/webrtc/transport/third_party/nICEr/nicer.gyp
index b617244f2fd..4bfd7d62d1f 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/nicer.gyp
+++ b/dom/media/webrtc/transport/third_party/nICEr/nicer.gyp
@@ -120,7 +120,6 @@
               'USE_TURN',
               'USE_ICE',
               'USE_RFC_3489_BACKWARDS_COMPATIBLE',
-              'USE_STUND_0_96',
               'USE_STUN_PEDANTIC',
               'USE_TURN',
               'NR_SOCKET_IS_VOID_PTR',
@@ -183,7 +182,6 @@
                     'USE_ICE',
                     'USE_TURN',
                     'USE_RFC_3489_BACKWARDS_COMPATIBLE',
-                    'USE_STUND_0_96',
                     'USE_STUN_PEDANTIC',
                     '_CRT_SECURE_NO_WARNINGS',
                     '__UNUSED__=',
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun.h b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun.h
index 2ea50172053..905105c4a27 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun.h
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun.h
@@ -89,10 +89,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 /* for backwards compatibility with obsolete versions of the STUN spec */
 #define NR_STUN_ATTR_OLD_XOR_MAPPED_ADDRESS  0x8020
 
-#ifdef USE_STUND_0_96
-#define NR_STUN_ATTR_OLD_CHANGE_REQUEST      0x0003
-#endif /* USE_STUND_0_96 */
-
 #ifdef USE_RFC_3489_BACKWARDS_COMPATIBLE
 /* for backwards compatibility with obsolete versions of the STUN spec */
 #define NR_STUN_ATTR_OLD_PASSWORD            0x0007
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.cpp
index a40c4adb705..2e4cc8ad42b 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.cpp
@@ -78,17 +78,6 @@ nr_stun_form_request_or_indication(int mode, int msg_type, nr_stun_message **msg
    case NR_STUN_MODE_STUN_NO_AUTH:
        req->header.magic_cookie = NR_STUN_MAGIC_COOKIE;
        break;
-
-#ifdef USE_STUND_0_96
-   case NR_STUN_MODE_STUND_0_96:
-       req->header.magic_cookie = NR_STUN_MAGIC_COOKIE2;
-
-       /* actually, stund 0.96 just ignores the fingerprint
-        * attribute, but don't bother to send it */
-
-       break;
-#endif /* USE_STUND_0_96 */
-
    }
 
    *msg = req;
@@ -189,31 +178,6 @@ nr_stun_build_keepalive(nr_stun_client_stun_keepalive_params *params, nr_stun_me
    return _status;
 }
 
-#ifdef USE_STUND_0_96
-int
-nr_stun_build_req_stund_0_96(nr_stun_client_stun_binding_request_stund_0_96_params *params, nr_stun_message **msg)
-{
-    int r,_status;
-    nr_stun_message *req = 0;
-
-    if ((r=nr_stun_form_request_or_indication(NR_STUN_MODE_STUND_0_96, NR_STUN_MSG_BINDING_REQUEST, &req)))
-        ABORT(r);
-
-    if ((r=nr_stun_message_add_change_request_attribute(req, 0)))
-        ABORT(r);
-
-    assert(! nr_stun_message_has_attribute(req, NR_STUN_ATTR_USERNAME, 0));
-    assert(! nr_stun_message_has_attribute(req, NR_STUN_ATTR_MESSAGE_INTEGRITY, 0));
-
-    *msg = req;
-
-   _status=0;
- abort:
-   if (_status) nr_stun_message_destroy(&req);
-   return _status;
-}
-#endif /* USE_STUND_0_96 */
-
 #ifdef USE_ICE
 int
 nr_stun_build_use_candidate(nr_stun_client_ice_binding_request_params *params, nr_stun_message **msg)
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.h b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.h
index dd53ef2fb17..35a22e039d5 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.h
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.h
@@ -37,9 +37,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #include "stun.h"
 
 #define NR_STUN_MODE_STUN               1
-#ifdef USE_STUND_0_96
-#define NR_STUN_MODE_STUND_0_96         2    /* backwards compatibility mode */
-#endif /* USE_STUND_0_96 */
 #define NR_STUN_MODE_STUN_NO_AUTH       3
 int nr_stun_form_request_or_indication(int mode, int msg_type, nr_stun_message **msg);
 
@@ -65,17 +62,6 @@ typedef struct nr_stun_client_stun_keepalive_params_ {
 int nr_stun_build_keepalive(nr_stun_client_stun_keepalive_params *params, nr_stun_message **msg);
 
 
-#ifdef USE_STUND_0_96
-typedef struct nr_stun_client_stun_binding_request_stund_0_96_params_ {
-#ifdef WIN32  // silly VC++ gives error if no members
-    int dummy;
-#endif
-} nr_stun_client_stun_binding_request_stund_0_96_params;
-
-int nr_stun_build_req_stund_0_96(nr_stun_client_stun_binding_request_stund_0_96_params *params, nr_stun_message **msg);
-#endif /* USE_STUND_0_96 */
-
-
 #ifdef USE_ICE
 typedef struct nr_stun_client_ice_binding_request_params_ {
     char *username;
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.cpp
index ee64d7a74c9..f2c1926947e 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.cpp
@@ -305,13 +305,6 @@ static int nr_stun_client_send_request(nr_stun_client_ctx *ctx)
             if ((r=nr_stun_build_keepalive(&ctx->params.stun_keepalive, &ctx->request)))
                 ABORT(r);
             break;
-#ifdef USE_STUND_0_96
-        case NR_STUN_CLIENT_MODE_BINDING_REQUEST_STUND_0_96:
-            if ((r=nr_stun_build_req_stund_0_96(&ctx->params.stun_binding_request_stund_0_96, &ctx->request)))
-                ABORT(r);
-            break;
-#endif /* USE_STUND_0_96 */
-
 #ifdef USE_ICE
         case NR_ICE_CLIENT_MODE_USE_CANDIDATE:
             if ((r=nr_stun_build_use_candidate(&ctx->params.ice_binding_request, &ctx->request)))
@@ -475,12 +468,6 @@ int nr_stun_client_process_response(nr_stun_client_ctx *ctx, UCHAR *msg, int len
       fail_on_error = 1;
       break;
 
-    case NR_STUN_CLIENT_MODE_BINDING_REQUEST_STUND_0_96:
-      /* If the STUN server responds with an error, give up, since we don't
-       * want to delay the completion of gathering. */
-      fail_on_error = 1;
-      break;
-
 #ifdef USE_ICE
     case NR_ICE_CLIENT_MODE_BINDING_REQUEST:
       /* We do not set fail_on_error here. The error might be transient, and
@@ -665,15 +652,6 @@ int nr_stun_client_process_response(nr_stun_client_ctx *ctx, UCHAR *msg, int len
         mapped_addr = &ctx->results.stun_binding_response.mapped_addr;
         break;
 
-    case NR_STUN_CLIENT_MODE_BINDING_REQUEST_STUND_0_96:
-        if (! nr_stun_message_has_attribute(ctx->response, NR_STUN_ATTR_MAPPED_ADDRESS, 0) && ! nr_stun_message_has_attribute(ctx->response, NR_STUN_ATTR_XOR_MAPPED_ADDRESS, 0)) {
-            r_log(NR_LOG_STUN,LOG_WARNING,"STUN-CLIENT(%s): No MAPPED-ADDRESS",ctx->label);
-            ABORT(R_BAD_DATA);
-        }
-
-        mapped_addr = &ctx->results.stun_binding_response_stund_0_96.mapped_addr;
-        break;
-
 #ifdef USE_ICE
     case NR_ICE_CLIENT_MODE_BINDING_REQUEST:
         if (! nr_stun_message_has_attribute(ctx->response, NR_STUN_ATTR_XOR_MAPPED_ADDRESS, 0)) {
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.h b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.h
index 7c9a176adf4..ea605ef9327 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.h
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.h
@@ -60,9 +60,6 @@ typedef union nr_stun_client_params_ {
 
     nr_stun_client_stun_binding_request_params               stun_binding_request;
     nr_stun_client_stun_keepalive_params                     stun_keepalive;
-#ifdef USE_STUND_0_96
-    nr_stun_client_stun_binding_request_stund_0_96_params    stun_binding_request_stund_0_96;
-#endif /* USE_STUND_0_96 */
 
 #ifdef USE_ICE
     nr_stun_client_ice_binding_request_params                ice_binding_request;
@@ -81,10 +78,6 @@ typedef struct nr_stun_client_stun_binding_response_results_ {
     nr_transport_addr mapped_addr;
 } nr_stun_client_stun_binding_response_results;
 
-typedef struct nr_stun_client_stun_binding_response_stund_0_96_results_ {
-    nr_transport_addr mapped_addr;
-} nr_stun_client_stun_binding_response_stund_0_96_results;
-
 #ifdef USE_ICE
 typedef struct nr_stun_client_ice_use_candidate_results_ {
 #ifdef WIN32  // silly VC++ gives error if no members
@@ -116,7 +109,6 @@ typedef struct nr_stun_client_permission_response_results_ {
 
 typedef union nr_stun_client_results_ {
     nr_stun_client_stun_binding_response_results              stun_binding_response;
-    nr_stun_client_stun_binding_response_stund_0_96_results   stun_binding_response_stund_0_96;
 
 #ifdef USE_ICE
     nr_stun_client_ice_use_candidate_results                  ice_use_candidate;
@@ -144,7 +136,6 @@ struct nr_stun_client_ctx_ {
 #define NR_STUN_CLIENT_MODE_BINDING_REQUEST_LONG_TERM_AUTH    2
 #define NR_STUN_CLIENT_MODE_BINDING_REQUEST_NO_AUTH           3
 #define NR_STUN_CLIENT_MODE_KEEPALIVE                         4
-#define NR_STUN_CLIENT_MODE_BINDING_REQUEST_STUND_0_96        5
 #ifdef USE_ICE
 #define NR_ICE_CLIENT_MODE_USE_CANDIDATE                  10
 #define NR_ICE_CLIENT_MODE_BINDING_REQUEST                11
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_codec.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_codec.cpp
index 2e8ef61741c..7ab40b91983 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_codec.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_codec.cpp
@@ -1189,9 +1189,6 @@ nr_stun_attr_codec nr_stun_attr_codec_xor_peer_address = {
 
 static nr_stun_attr_info attrs[] = {
    NR_ADD_STUN_ATTRIBUTE(NR_STUN_ATTR_ALTERNATE_SERVER, "ALTERNATE-SERVER", nr_stun_attr_codec_addr, 0)
-#ifdef USE_STUND_0_96
-   NR_ADD_STUN_ATTRIBUTE(NR_STUN_ATTR_OLD_CHANGE_REQUEST, "CHANGE-REQUEST", nr_stun_attr_codec_UINT4, 0)
-#endif
    NR_ADD_STUN_ATTRIBUTE(NR_STUN_ATTR_ERROR_CODE, "ERROR-CODE", nr_stun_attr_codec_error_code, nr_stun_attr_error_code_illegal)
    NR_ADD_STUN_ATTRIBUTE(NR_STUN_ATTR_FINGERPRINT, "FINGERPRINT", nr_stun_attr_codec_fingerprint, 0)
    NR_ADD_STUN_ATTRIBUTE(NR_STUN_ATTR_MAPPED_ADDRESS, "MAPPED-ADDRESS", nr_stun_attr_codec_addr, 0)
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_hint.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_hint.cpp
index b59c543269f..6faf6784fb7 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_hint.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_hint.cpp
@@ -54,7 +54,6 @@ int
 nr_is_stun_message(UCHAR *buf, size_t len)
 {
    const UINT4 cookie = htonl(NR_STUN_MAGIC_COOKIE);
-   const UINT4 cookie2 = htonl(NR_STUN_MAGIC_COOKIE2);
    UINT2 type;
    nr_stun_encoded_attribute* attr;
    unsigned int attrLen;
@@ -111,12 +110,6 @@ nr_is_stun_message(UCHAR *buf, size_t len)
         break;
    }
 
-   if (!memcmp(&cookie2, &buf[4], sizeof(UINT4))) {
-       /* return here because if it's an old-style message then there will
-        * not be a fingerprint in the message */
-       return 1;
-   }
-
    if (memcmp(&cookie, &buf[4], sizeof(UINT4)))
        return 0;
 
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.cpp
index 1f0fb76a257..dad5b4ac9ed 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.cpp
@@ -353,12 +353,3 @@ NR_STUN_MESSAGE_ADD_ATTRIBUTE(
 
 #endif /* USE_TURN */
 
-#ifdef USE_STUND_0_96
-int
-nr_stun_message_add_change_request_attribute(nr_stun_message *msg, UINT4 change_request)
-NR_STUN_MESSAGE_ADD_ATTRIBUTE(
-    NR_STUN_ATTR_OLD_CHANGE_REQUEST,
-    { attr->u.change_request = change_request; }
-)
-#endif /* USE_STUND_0_96 */
-
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.h b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.h
index d5a283e4857..2e1d79b817e 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.h
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.h
@@ -53,7 +53,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #define NR_STUN_MAX_MESSAGE_SIZE                   2048
 
 #define NR_STUN_MAGIC_COOKIE            0x2112A442
-#define NR_STUN_MAGIC_COOKIE2           0xc5cb4e1d  /* used recognize old stun messages */
 
 typedef struct { UCHAR octet[12]; }  UINT12;
 
@@ -128,10 +127,6 @@ typedef struct nr_stun_message_attribute_ {
         nr_stun_attr_data               data;
 #endif /* USE_TURN */
 
-#ifdef USE_STUND_0_96
-        UINT4                           change_request;
-#endif /* USE_STUND_0_96 */
-
         /* make sure there's enough room here to place any possible
          * attribute */
         UCHAR                           largest_possible_attribute[NR_STUN_MAX_MESSAGE_SIZE];
@@ -200,9 +195,5 @@ int
 nr_stun_message_add_xor_peer_address_attribute(nr_stun_message *msg, nr_transport_addr *peer_address);
 #endif /* USE_TURN */
 
-#ifdef USE_STUND_0_96
-int nr_stun_message_add_change_request_attribute(nr_stun_message *msg, UINT4 change_request);
-#endif /* USE_STUND_0_96 */
-
 #endif
 
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_proc.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_proc.cpp
index 51800283c02..e621084cf92 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_proc.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_proc.cpp
@@ -61,8 +61,7 @@ nr_stun_receive_message(nr_stun_message *req, nr_stun_message *msg)
     /* if this message was generated by an RFC 3489 impementation,
      * the call to nr_is_stun_message will fail, so skip that
      * check and puke elsewhere if the message can't be decoded */
-    if (msg->header.magic_cookie == NR_STUN_MAGIC_COOKIE
-     || msg->header.magic_cookie == NR_STUN_MAGIC_COOKIE2) {
+    if (msg->header.magic_cookie == NR_STUN_MAGIC_COOKIE) {
 #endif /* USE_RFC_3489_BACKWARDS_COMPATIBLE */
     if (!nr_is_stun_message(msg->buffer, msg->length)) {
         r_log(NR_LOG_STUN, LOG_WARNING, "Not a STUN message");
@@ -108,12 +107,6 @@ nr_stun_receive_message(nr_stun_message *req, nr_stun_message *msg)
 
         break;
 
-#ifdef USE_STUND_0_96
-    case NR_STUN_MAGIC_COOKIE2:
-        /* nothing to check in this case */
-        break;
-#endif /* USE_STUND_0_96 */
-
     default:
 #ifdef USE_RFC_3489_BACKWARDS_COMPATIBLE
         /* in RFC 3489 there is no magic cookie, it's part of the transaction ID */
@@ -325,12 +318,6 @@ nr_stun_receive_request_or_indication_short_term_auth(nr_stun_message *msg,
         }
 
         break;
-
-#ifdef USE_STUND_0_96
-    case NR_STUN_MAGIC_COOKIE2:
-        /* nothing to check in this case */
-        break;
-#endif /* USE_STUND_0_96 */
     }
 
     _status=0;
@@ -361,12 +348,6 @@ nr_stun_receive_response_short_term_auth(nr_stun_message *res)
         }
 
         break;
-
-#ifdef USE_STUND_0_96
-    case NR_STUN_MAGIC_COOKIE2:
-        /* nothing to check in this case */
-        break;
-#endif /* USE_STUND_0_96 */
     }
 
    _status=0;
@@ -483,12 +464,6 @@ nr_stun_receive_request_long_term_auth(nr_stun_message *req, nr_stun_server_ctx
         }
 
         break;
-
-#ifdef USE_STUND_0_96
-    case NR_STUN_MAGIC_COOKIE2:
-        /* nothing to do in this case */
-        break;
-#endif /* USE_STUND_0_96 */
     }
 
     _status=0;
@@ -539,12 +514,6 @@ nr_stun_receive_response_long_term_auth(nr_stun_message *res, nr_stun_client_ctx
         }
 
         break;
-
-#ifdef USE_STUND_0_96
-    case NR_STUN_MAGIC_COOKIE2:
-        /* nothing to check in this case */
-        break;
-#endif /* USE_STUND_0_96 */
     }
 
     _status=0;
Loading diff…