Firefox · DOM
CVE-2026-118005
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
TransformableFrameInterfacedom/media/webrtc/jsapi/RTCEncodedFrameBase.h |
modified | |
ErrorResultdom/media/webrtc/jsapi/RTCEncodedFrameBase.h |
modified | |
RTCRtpScriptTransformerdom/media/webrtc/jsapi/RTCEncodedFrameBase.h |
modified |
Files Changed
dom/media/webrtc/jsapi/RTCEncodedFrameBase.cppdom/media/webrtc/jsapi/RTCEncodedFrameBase.hdom/webidl/RTCEncodedAudioFrame.webidldom/webidl/RTCEncodedVideoFrame.webidl
Patch
diff --git a/dom/media/webrtc/jsapi/RTCEncodedFrameBase.cpp b/dom/media/webrtc/jsapi/RTCEncodedFrameBase.cpp
index dba3d51206c..747524a81df 100644
--- a/dom/media/webrtc/jsapi/RTCEncodedFrameBase.cpp
+++ b/dom/media/webrtc/jsapi/RTCEncodedFrameBase.cpp
@@ -111,8 +111,19 @@ nsIGlobalObject* RTCEncodedFrameBase::GetParentObject() const {
return mGlobal;
}
-void RTCEncodedFrameBase::SetData(const ArrayBuffer& aData) {
- mData.set(aData.Obj());
+void RTCEncodedFrameBase::SetData(const ArrayBuffer& aData, ErrorResult& aRv) {
+ AutoJSAPI jsapi;
+ if (NS_WARN_IF(!jsapi.Init(mGlobal))) {
+ aRv.Throw(NS_ERROR_FAILURE);
+ return;
+ }
+ JSContext* cx = jsapi.cx();
+ JS::Rooted<JSObject*> data(cx, aData.Obj());
+ if (!JS_WrapObject(cx, &data)) {
+ aRv.StealExceptionFromJSContext(cx);
+ return;
+ }
+ mData = data;
}
void RTCEncodedFrameBase::GetData(JSContext* aCx,
@@ -132,8 +143,11 @@ bool RTCEncodedFrameBase::CopyData(JSContext* aCx,
return false;
}
- JS::Rooted<JSObject*> original(aCx, mData);
- aData.set(JS::CopyArrayBuffer(aCx, original));
+ JS::Rooted<JSObject*> data(aCx, mData);
+ if (!JS_WrapObject(aCx, &data)) {
+ return false;
+ }
+ aData.set(JS::CopyArrayBuffer(aCx, data));
return !NS_WARN_IF(!aData);
}
@@ -147,6 +161,10 @@ bool RTCEncodedFrameBase::WriteData(JSContext* aCx,
// JS_WriteTypedArray does not take a bare ArrayBuffer, so hand it a view.
// TODO: Update this once bug 2067921 is fixed.
JS::Rooted<JSObject*> buffer(aCx, mData);
+ // Put this in the right compartment
+ if (NS_WARN_IF(!JS_WrapObject(aCx, &buffer))) {
+ return false;
+ }
JS::Rooted<JSObject*> view(aCx,
JS_NewUint8ArrayWithBuffer(aCx, buffer, 0, -1));
if (NS_WARN_IF(!view)) {
diff --git a/dom/media/webrtc/jsapi/RTCEncodedFrameBase.h b/dom/media/webrtc/jsapi/RTCEncodedFrameBase.h
index f73f75a1a51..ad60fc5a934 100644
--- a/dom/media/webrtc/jsapi/RTCEncodedFrameBase.h
+++ b/dom/media/webrtc/jsapi/RTCEncodedFrameBase.h
@@ -18,7 +18,11 @@ namespace webrtc {
class TransformableFrameInterface;
}
-namespace mozilla::dom {
+namespace mozilla {
+
+class ErrorResult;
+
+namespace dom {
class RTCRtpScriptTransformer;
@@ -50,7 +54,7 @@ class RTCEncodedFrameBase : public nsISupports, public nsWrapperCache {
nsIGlobalObject* GetParentObject() const;
- void SetData(const ArrayBuffer& aData);
+ void SetData(const ArrayBuffer& aData, ErrorResult& aRv);
void GetData(JSContext* aCx, JS::Rooted<JSObject*>* aObj) const;
@@ -98,5 +102,6 @@ class RTCEncodedFrameBase : public nsISupports, public nsWrapperCache {
uint64_t mCounter = 0;
};
-} // namespace mozilla::dom
+} // namespace dom
+} // namespace mozilla
#endif // MOZILLA_DOM_MEDIA_WEBRTC_JSAPI_RTCENCODEDFRAMEBASE_H_
diff --git a/dom/webidl/RTCEncodedAudioFrame.webidl b/dom/webidl/RTCEncodedAudioFrame.webidl
index 412624fc0ac..05538a31123 100644
--- a/dom/webidl/RTCEncodedAudioFrame.webidl
+++ b/dom/webidl/RTCEncodedAudioFrame.webidl
@@ -24,6 +24,7 @@ interface RTCEncodedAudioFrame {
[Throws]
constructor(RTCEncodedAudioFrame originalFrame, optional RTCEncodedAudioFrameOptions options = {});
readonly attribute unsigned long timestamp; // legacy name of metadata rtpTimestamp
+ [SetterThrows]
attribute ArrayBuffer data;
RTCEncodedAudioFrameMetadata getMetadata();
};
diff --git a/dom/webidl/RTCEncodedVideoFrame.webidl b/dom/webidl/RTCEncodedVideoFrame.webidl
index 441b450fe24..c49507c953d 100644
--- a/dom/webidl/RTCEncodedVideoFrame.webidl
+++ b/dom/webidl/RTCEncodedVideoFrame.webidl
@@ -41,6 +41,7 @@ interface RTCEncodedVideoFrame {
constructor(RTCEncodedVideoFrame originalFrame, optional RTCEncodedVideoFrameOptions options = {});
readonly attribute RTCEncodedVideoFrameType type;
readonly attribute unsigned long timestamp; // legacy name of metadata rtpTimestamp
+ [SetterThrows]
attribute ArrayBuffer data;
RTCEncodedVideoFrameMetadata getMetadata();
};
Loading diff…
References
On This Page