Firefox · Toolkit
CVE-2026-16350
Logic Error in Toolkit
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
.cargo/config.toml.inCargo.lockthird_party/rust/audioipc2-client/.cargo-checksum.jsonthird_party/rust/audioipc2-client/src/context.rsthird_party/rust/audioipc2-client/src/stream.rsthird_party/rust/audioipc2-server/.cargo-checksum.jsonthird_party/rust/audioipc2-server/src/server.rsthird_party/rust/audioipc2/.cargo-checksum.jsonthird_party/rust/audioipc2/src/messages.rstoolkit/library/rust/shared/Cargo.toml
Patch
diff --git a/.cargo/config.toml.in b/.cargo/config.toml.in
index 57e58ed55db..2f0a7b9fe08 100644
--- a/.cargo/config.toml.in
+++ b/.cargo/config.toml.in
@@ -65,9 +65,9 @@ git = "https://github.com/martinthomson/ohttp"
rev = "600931b5a1e947776cbaad931ed78f1e89005352"
replace-with = "vendored-sources"
-[source."git+https://github.com/mozilla/audioipc?rev=042d48dc5932ced772c2bf20a2aef2845fd6ec85"]
+[source."git+https://github.com/mozilla/audioipc?rev=c9dcbaee1624daad2fa6b1445fd047efde4f1ec0"]
git = "https://github.com/mozilla/audioipc"
-rev = "042d48dc5932ced772c2bf20a2aef2845fd6ec85"
+rev = "c9dcbaee1624daad2fa6b1445fd047efde4f1ec0"
replace-with = "vendored-sources"
[source."git+https://github.com/mozilla/authenticator-rs?tag=v0.6.0"]
diff --git a/Cargo.lock b/Cargo.lock
index ca556fa40c6..b643010d068 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -365,7 +365,7 @@ dependencies = [
[[package]]
name = "audioipc2"
version = "0.6.0"
-source = "git+https://github.com/mozilla/audioipc?rev=042d48dc5932ced772c2bf20a2aef2845fd6ec85#042d48dc5932ced772c2bf20a2aef2845fd6ec85"
+source = "git+https://github.com/mozilla/audioipc?rev=c9dcbaee1624daad2fa6b1445fd047efde4f1ec0#c9dcbaee1624daad2fa6b1445fd047efde4f1ec0"
dependencies = [
"arrayvec",
"ashmem",
@@ -391,7 +391,7 @@ dependencies = [
[[package]]
name = "audioipc2-client"
version = "0.6.0"
-source = "git+https://github.com/mozilla/audioipc?rev=042d48dc5932ced772c2bf20a2aef2845fd6ec85#042d48dc5932ced772c2bf20a2aef2845fd6ec85"
+source = "git+https://github.com/mozilla/audioipc?rev=c9dcbaee1624daad2fa6b1445fd047efde4f1ec0#c9dcbaee1624daad2fa6b1445fd047efde4f1ec0"
dependencies = [
"audio_thread_priority",
"audioipc2",
@@ -402,7 +402,7 @@ dependencies = [
[[package]]
name = "audioipc2-server"
version = "0.6.0"
-source = "git+https://github.com/mozilla/audioipc?rev=042d48dc5932ced772c2bf20a2aef2845fd6ec85#042d48dc5932ced772c2bf20a2aef2845fd6ec85"
+source = "git+https://github.com/mozilla/audioipc?rev=c9dcbaee1624daad2fa6b1445fd047efde4f1ec0#c9dcbaee1624daad2fa6b1445fd047efde4f1ec0"
dependencies = [
"audio_thread_priority",
"audioipc2",
diff --git a/third_party/rust/audioipc2-client/.cargo-checksum.json b/third_party/rust/audioipc2-client/.cargo-checksum.json
index 7661d4ed4cc..5b8ce76ed95 100644
--- a/third_party/rust/audioipc2-client/.cargo-checksum.json
+++ b/third_party/rust/audioipc2-client/.cargo-checksum.json
@@ -1 +1 @@
-{"files":{"Cargo.toml":"8041e238fb1492f52e6f6c34ba43496208ebbf2acc3dd87faaac0c7f0af1dc01","cbindgen.toml":"fb6abe1671497f432a06e40b1db7ed7cd2cceecbd9a2382193ad7534e8855e34","src/context.rs":"241233793a343f930f868327a62903f0ab845a17ae44b0afa809dcd245641a16","src/lib.rs":"0322bba9529c81c891bc2c033d402590058014da0df0730dbf9532380c2dabe8","src/send_recv.rs":"cd396a704f205d4ef680f484461a065aa29f624603d5031f9973779826fb3c19","src/stream.rs":"4f08831749d5cb393db6bfbf0c66cdc71e9a06418927929dadce4737a391c4b2"},"package":null}
\ No newline at end of file
+{"files":{"Cargo.toml":"8041e238fb1492f52e6f6c34ba43496208ebbf2acc3dd87faaac0c7f0af1dc01","cbindgen.toml":"fb6abe1671497f432a06e40b1db7ed7cd2cceecbd9a2382193ad7534e8855e34","src/context.rs":"c351b782e9bb83a1fbc5127e07a4d06c59978256bb0dc265df256eb948a6cf4e","src/lib.rs":"0322bba9529c81c891bc2c033d402590058014da0df0730dbf9532380c2dabe8","src/send_recv.rs":"cd396a704f205d4ef680f484461a065aa29f624603d5031f9973779826fb3c19","src/stream.rs":"d7d4967c8ef760a58592aff23157357646528c1c83c9de394e1f9c8043f72a81"},"package":null}
\ No newline at end of file
diff --git a/third_party/rust/audioipc2-client/src/context.rs b/third_party/rust/audioipc2-client/src/context.rs
index 7025ee2c630..40790965bab 100644
--- a/third_party/rust/audioipc2-client/src/context.rs
+++ b/third_party/rust/audioipc2-client/src/context.rs
@@ -297,7 +297,7 @@ impl ContextOps for ClientContext {
let input_stream_params = input_stream_params.map(messages::StreamParams::from);
let output_stream_params = output_stream_params.map(messages::StreamParams::from);
- let init_params = messages::StreamInitParams {
+ let params = messages::StreamCreateParams {
stream_name,
input_device: input_device as usize,
input_stream_params,
@@ -305,7 +305,7 @@ impl ContextOps for ClientContext {
output_stream_params,
latency_frames,
};
- stream::init(self, init_params, data_callback, state_callback, user_ptr)
+ stream::init(self, params, data_callback, state_callback, user_ptr)
}
fn register_device_collection_changed(
diff --git a/third_party/rust/audioipc2-client/src/stream.rs b/third_party/rust/audioipc2-client/src/stream.rs
index bfa9c9613d9..07378c060f4 100644
--- a/third_party/rust/audioipc2-client/src/stream.rs
+++ b/third_party/rust/audioipc2-client/src/stream.rs
@@ -5,7 +5,6 @@
use crate::ClientContext;
use crate::{assert_not_in_callback, run_in_callback};
-use audioipc::messages::StreamCreateParams;
use audioipc::messages::{self, CallbackReq, CallbackResp, ClientMessage, ServerMessage};
use audioipc::shm::SharedMem;
use audioipc::{rpccore, sys};
@@ -166,27 +165,25 @@ impl rpccore::Server for CallbackServer {
impl<'ctx> ClientStream<'ctx> {
fn init(
ctx: &'ctx ClientContext,
- init_params: messages::StreamInitParams,
+ params: messages::StreamCreateParams,
data_callback: ffi::cubeb_data_callback,
state_callback: ffi::cubeb_state_callback,
user_ptr: *mut c_void,
) -> Result<Stream> {
assert_not_in_callback();
- let input_frame_size = init_params
+ let has_input = params.input_stream_params.is_some();
+ let has_output = params.output_stream_params.is_some();
+ let input_frame_size = params
.input_stream_params
.as_ref()
.map(messages::StreamParams::frame_size_in_bytes);
- let output_frame_size = init_params
+ let output_frame_size = params
.output_stream_params
.as_ref()
.map(messages::StreamParams::frame_size_in_bytes);
let rpc = ctx.rpc();
- let create_params = StreamCreateParams {
- input_stream_params: init_params.input_stream_params,
- output_stream_params: init_params.output_stream_params,
- };
- let mut data = send_recv!(rpc, StreamCreate(create_params) => StreamCreated())?;
+ let mut data = send_recv!(rpc, StreamCreate(params) => StreamCreated())?;
debug!(
"token = {}, handle = {:?} area_size = {:?}",
@@ -205,10 +202,7 @@ impl<'ctx> ClientStream<'ctx> {
}
};
- let duplex_input = if let (Some(_), Some(_)) = (
- init_params.input_stream_params,
- init_params.output_stream_params,
- ) {
+ let duplex_input = if has_input && has_output {
let mut duplex_input = Vec::new();
match duplex_input.try_reserve_exact(data.shm_area_size) {
Ok(()) => Some(duplex_input),
@@ -224,8 +218,7 @@ impl<'ctx> ClientStream<'ctx> {
None
};
- let mut stream =
- send_recv!(rpc, StreamInit(data.token, init_params) => StreamInitialized())?;
+ let mut stream = send_recv!(rpc, StreamInit(data.token) => StreamInitialized())?;
let stream = unsafe { sys::Pipe::from_raw_handle(stream.take_handle()) };
let user_data = user_ptr as usize;
@@ -367,12 +360,12 @@ impl StreamOps for ClientStream<'_> {
pub fn init(
ctx: &ClientContext,
- init_params: messages::StreamInitParams,
+ params: messages::StreamCreateParams,
data_callback: ffi::cubeb_data_callback,
state_callback: ffi::cubeb_state_callback,
user_ptr: *mut c_void,
) -> Result<Stream> {
- let stm = ClientStream::init(ctx, init_params, data_callback, state_callback, user_ptr)?;
+ let stm = ClientStream::init(ctx, params, data_callback, state_callback, user_ptr)?;
debug_assert_eq!(stm.user_ptr(), user_ptr);
Ok(stm)
}
diff --git a/third_party/rust/audioipc2-server/.cargo-checksum.json b/third_party/rust/audioipc2-server/.cargo-checksum.json
index a5aa180bae6..640ba1b6f06 100644
--- a/third_party/rust/audioipc2-server/.cargo-checksum.json
+++ b/third_party/rust/audioipc2-server/.cargo-checksum.json
@@ -1 +1 @@
-{"files":{"Cargo.toml":"cb7cde50cf3ed08b5cd40d8f118d7101ec863942d506eebc26595662a7cc5b58","cbindgen.toml":"fb6abe1671497f432a06e40b1db7ed7cd2cceecbd9a2382193ad7534e8855e34","src/lib.rs":"a19c1bad94e16a0cfcd1e93c25b97bf58cc00e9666b5c31652d8a2242decb36c","src/server.rs":"1a8c83c67f4bb834646b55279e4a6d473d0b1ad1033108bc3a8399471e6e0652"},"package":null}
\ No newline at end of file
+{"files":{"Cargo.toml":"cb7cde50cf3ed08b5cd40d8f118d7101ec863942d506eebc26595662a7cc5b58","cbindgen.toml":"fb6abe1671497f432a06e40b1db7ed7cd2cceecbd9a2382193ad7534e8855e34","src/lib.rs":"a19c1bad94e16a0cfcd1e93c25b97bf58cc00e9666b5c31652d8a2242decb36c","src/server.rs":"28d494e2d4a6ad673f77912578179eb7b1b8b927d7fd63048d099284d03aeda7"},"package":null}
\ No newline at end of file
diff --git a/third_party/rust/audioipc2-server/src/server.rs b/third_party/rust/audioipc2-server/src/server.rs
index 90337418abf..eb550c83d07 100644
--- a/third_party/rust/audioipc2-server/src/server.rs
+++ b/third_party/rust/audioipc2-server/src/server.rs
@@ -9,7 +9,7 @@ use audioipc::messages::SerializableHandle;
use audioipc::messages::{
CallbackReq, CallbackResp, ClientMessage, Device, DeviceCollectionReq, DeviceCollectionResp,
DeviceInfo, RegisterDeviceCollectionChanged, ServerMessage, StreamCreate, StreamCreateParams,
- StreamInitParams, StreamParams,
+ StreamParams,
};
use audioipc::shm::SharedMem;
use audioipc::{ipccore, rpccore, sys, PlatformHandle};
@@ -356,10 +356,61 @@ fn get_shm_id() -> String {
)
}
+fn validate_stream_params(p: &StreamParams) -> cubeb::Result<()> {
+ const MAX_CHANNELS: u32 = u8::MAX as u32;
+ const MIN_RATE: u32 = 1_000;
+ const MAX_RATE: u32 = 768_000;
+
+ let valid_format = matches!(
+ p.format,
+ ffi::CUBEB_SAMPLE_S16LE
+ | ffi::CUBEB_SAMPLE_S16BE
+ | ffi::CUBEB_SAMPLE_FLOAT32LE
+ | ffi::CUBEB_SAMPLE_FLOAT32BE
+ );
+
Loading diff…
References
On This Page