Firefox · Core
CVE-2026-2758
UAF in Core
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifmfbt/HashTable.h |
modified |
Files Changed
mfbt/HashTable.h
Patch
diff --git a/mfbt/HashTable.h b/mfbt/HashTable.h
index 67a5f25bf64..311b638d3af 100644
--- a/mfbt/HashTable.h
+++ b/mfbt/HashTable.h
@@ -1113,7 +1113,7 @@ class HashTableEntry {
void destroy() { destroyStoredT(); }
- void swap(HashTableEntry* aOther, bool aIsLive) {
+ void swap(HashTableEntry* aOther, bool aOtherIsLive) {
// This allows types to use Argument-Dependent-Lookup, and thus use a custom
// std::swap, which is needed by types like JS::Heap and such.
using std::swap;
@@ -1121,10 +1121,10 @@ class HashTableEntry {
if (this == aOther) {
return;
}
- if (aIsLive) {
+ if (aOtherIsLive) {
swap(*valuePtr(), *aOther->valuePtr());
} else {
- *aOther->valuePtr() = std::move(*valuePtr());
+ new (KnownNotNull, aOther->valuePtr()) NonConstT(std::move(*valuePtr()));
destroy();
}
}
Loading diff…
References
On This Page