Firefox · SpiderMonkey
CVE-2026-16412
Memory Corruption in SpiderMonkey
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
js/src/wasm/WasmInstance.cppjs/src/wasm/WasmTable.cpp
Patch
diff --git a/js/src/wasm/WasmInstance.cpp b/js/src/wasm/WasmInstance.cpp
index 8493d4d994e..a12cf979ea4 100644
--- a/js/src/wasm/WasmInstance.cpp
+++ b/js/src/wasm/WasmInstance.cpp
@@ -3895,6 +3895,8 @@ static bool WasmCall(JSContext* cx, unsigned argc, Value* vp) {
bool Instance::getExportedFunction(JSContext* cx, uint32_t funcIndex,
MutableHandleFunction result) {
+ MOZ_RELEASE_ASSERT(realm() == cx->realm());
+
uint32_t funcExportIndex = codeMeta().findFuncExportIndex(funcIndex);
FuncExportInstanceData& instanceData =
funcExportInstanceData(funcExportIndex);
diff --git a/js/src/wasm/WasmTable.cpp b/js/src/wasm/WasmTable.cpp
index 2bcdcf43f23..daf45189206 100644
--- a/js/src/wasm/WasmTable.cpp
+++ b/js/src/wasm/WasmTable.cpp
@@ -19,12 +19,12 @@
#include "mozilla/CheckedInt.h"
#include "vm/JSContext.h"
-#include "vm/Realm.h"
#include "wasm/WasmInstance.h"
#include "wasm/WasmJS.h"
#include "wasm/WasmValue.h"
#include "gc/StableCellHasher-inl.h"
+#include "vm/Realm-inl.h"
#include "wasm/WasmInstance-inl.h"
using namespace js;
@@ -171,6 +171,7 @@ bool Table::getFuncRef(JSContext* cx, uint32_t address,
Instance& instance = *elem.instance;
const CodeRange& codeRange = *instance.code().lookupFuncRange(elem.code);
+ AutoRealmUnchecked ar(cx, instance.realm());
return instance.getExportedFunction(cx, codeRange.funcIndex(), fun);
}
Loading diff…
References
On This Page