High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the WebRTC: Signaling component
ComponentDOM
Bug ClassLogic Error
Tracker2073653
Fix commit3f373ae59cb0 (firefox) +32/-7
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-27

Changed Functions

FunctionChangeNotes
TransformableFrameInterface
dom/media/webrtc/jsapi/RTCEncodedFrameBase.h
modified
ErrorResult
dom/media/webrtc/jsapi/RTCEncodedFrameBase.h
modified
RTCRtpScriptTransformer
dom/media/webrtc/jsapi/RTCEncodedFrameBase.h
modified

Files Changed

  • dom/media/webrtc/jsapi/RTCEncodedFrameBase.cpp
  • dom/media/webrtc/jsapi/RTCEncodedFrameBase.h
  • dom/webidl/RTCEncodedAudioFrame.webidl
  • dom/webidl/RTCEncodedVideoFrame.webidl
diff --git a/dom/media/webrtc/jsapi/RTCEncodedFrameBase.cpp b/dom/media/webrtc/jsapi/RTCEncodedFrameBase.cpp
index dba3d51206c..747524a81df 100644
--- a/dom/media/webrtc/jsapi/RTCEncodedFrameBase.cpp
+++ b/dom/media/webrtc/jsapi/RTCEncodedFrameBase.cpp
@@ -111,8 +111,19 @@ nsIGlobalObject* RTCEncodedFrameBase::GetParentObject() const {
   return mGlobal;
 }
 
-void RTCEncodedFrameBase::SetData(const ArrayBuffer& aData) {
-  mData.set(aData.Obj());
+void RTCEncodedFrameBase::SetData(const ArrayBuffer& aData, ErrorResult& aRv) {
+  AutoJSAPI jsapi;
+  if (NS_WARN_IF(!jsapi.Init(mGlobal))) {
+    aRv.Throw(NS_ERROR_FAILURE);
+    return;
+  }
+  JSContext* cx = jsapi.cx();
+  JS::Rooted<JSObject*> data(cx, aData.Obj());
+  if (!JS_WrapObject(cx, &data)) {
+    aRv.StealExceptionFromJSContext(cx);
+    return;
+  }
+  mData = data;
 }
 
 void RTCEncodedFrameBase::GetData(JSContext* aCx,
@@ -132,8 +143,11 @@ bool RTCEncodedFrameBase::CopyData(JSContext* aCx,
     return false;
   }
 
-  JS::Rooted<JSObject*> original(aCx, mData);
-  aData.set(JS::CopyArrayBuffer(aCx, original));
+  JS::Rooted<JSObject*> data(aCx, mData);
+  if (!JS_WrapObject(aCx, &data)) {
+    return false;
+  }
+  aData.set(JS::CopyArrayBuffer(aCx, data));
   return !NS_WARN_IF(!aData);
 }
 
@@ -147,6 +161,10 @@ bool RTCEncodedFrameBase::WriteData(JSContext* aCx,
   // JS_WriteTypedArray does not take a bare ArrayBuffer, so hand it a view.
   // TODO: Update this once bug 2067921 is fixed.
   JS::Rooted<JSObject*> buffer(aCx, mData);
+  // Put this in the right compartment
+  if (NS_WARN_IF(!JS_WrapObject(aCx, &buffer))) {
+    return false;
+  }
   JS::Rooted<JSObject*> view(aCx,
                              JS_NewUint8ArrayWithBuffer(aCx, buffer, 0, -1));
   if (NS_WARN_IF(!view)) {
diff --git a/dom/media/webrtc/jsapi/RTCEncodedFrameBase.h b/dom/media/webrtc/jsapi/RTCEncodedFrameBase.h
index f73f75a1a51..ad60fc5a934 100644
--- a/dom/media/webrtc/jsapi/RTCEncodedFrameBase.h
+++ b/dom/media/webrtc/jsapi/RTCEncodedFrameBase.h
@@ -18,7 +18,11 @@ namespace webrtc {
 class TransformableFrameInterface;
 }
 
-namespace mozilla::dom {
+namespace mozilla {
+
+class ErrorResult;
+
+namespace dom {
 
 class RTCRtpScriptTransformer;
 
@@ -50,7 +54,7 @@ class RTCEncodedFrameBase : public nsISupports, public nsWrapperCache {
 
   nsIGlobalObject* GetParentObject() const;
 
-  void SetData(const ArrayBuffer& aData);
+  void SetData(const ArrayBuffer& aData, ErrorResult& aRv);
 
   void GetData(JSContext* aCx, JS::Rooted<JSObject*>* aObj) const;
 
@@ -98,5 +102,6 @@ class RTCEncodedFrameBase : public nsISupports, public nsWrapperCache {
   uint64_t mCounter = 0;
 };
 
-}  // namespace mozilla::dom
+}  // namespace dom
+}  // namespace mozilla
 #endif  // MOZILLA_DOM_MEDIA_WEBRTC_JSAPI_RTCENCODEDFRAMEBASE_H_
diff --git a/dom/webidl/RTCEncodedAudioFrame.webidl b/dom/webidl/RTCEncodedAudioFrame.webidl
index 412624fc0ac..05538a31123 100644
--- a/dom/webidl/RTCEncodedAudioFrame.webidl
+++ b/dom/webidl/RTCEncodedAudioFrame.webidl
@@ -24,6 +24,7 @@ interface RTCEncodedAudioFrame {
     [Throws]
     constructor(RTCEncodedAudioFrame originalFrame, optional RTCEncodedAudioFrameOptions options = {});
     readonly attribute unsigned long timestamp;    // legacy name of metadata rtpTimestamp
+    [SetterThrows]
     attribute ArrayBuffer data;
     RTCEncodedAudioFrameMetadata getMetadata();
 };
diff --git a/dom/webidl/RTCEncodedVideoFrame.webidl b/dom/webidl/RTCEncodedVideoFrame.webidl
index 441b450fe24..c49507c953d 100644
--- a/dom/webidl/RTCEncodedVideoFrame.webidl
+++ b/dom/webidl/RTCEncodedVideoFrame.webidl
@@ -41,6 +41,7 @@ interface RTCEncodedVideoFrame {
     constructor(RTCEncodedVideoFrame originalFrame, optional RTCEncodedVideoFrameOptions options = {});
     readonly attribute RTCEncodedVideoFrameType type;
     readonly attribute unsigned long timestamp;    // legacy name of metadata rtpTimestamp
+    [SetterThrows]
     attribute ArrayBuffer data;
     RTCEncodedVideoFrameMetadata getMetadata();
 };
Loading diff…