Firefox · Core
CVE-2026-2775
Logic Error in Core
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
parser/html/nsHtml5TreeOperation.cpp
Patch
diff --git a/parser/html/nsHtml5TreeOperation.cpp b/parser/html/nsHtml5TreeOperation.cpp
index 612df861256..ef2bf317aa7 100644
--- a/parser/html/nsHtml5TreeOperation.cpp
+++ b/parser/html/nsHtml5TreeOperation.cpp
@@ -266,6 +266,7 @@ nsresult nsHtml5TreeOperation::Append(nsIContent* aNode, nsIContent* aParent,
nsHtml5DocumentBuilder* aBuilder) {
MOZ_ASSERT(aBuilder);
MOZ_ASSERT(aBuilder->IsInDocUpdate());
+ MOZ_ASSERT(!aNode->GetParentNode());
ErrorResult rv;
Document* ownerDoc = aParent->OwnerDoc();
nsHtml5OtherDocUpdate update(ownerDoc, aBuilder->GetDocument());
@@ -281,6 +282,13 @@ nsresult nsHtml5TreeOperation::Append(nsIContent* aNode, nsIContent* aParent,
nsresult nsHtml5TreeOperation::Append(nsIContent* aNode, nsIContent* aParent,
FromParser aFromParser,
nsHtml5DocumentBuilder* aBuilder) {
+ if (MOZ_UNLIKELY(aNode->GetParentNode())) {
+ Detach(aNode, aBuilder);
+ if (MOZ_UNLIKELY(aNode->GetParentNode())) {
+ // Can this happen? If it can, give up.
+ return NS_OK;
+ }
+ }
Maybe<nsHtml5AutoPauseUpdate> autoPause;
Maybe<AutoCEReaction> autoCEReaction;
DocGroup* docGroup = aParent->OwnerDoc()->GetDocGroup();
@@ -303,6 +311,13 @@ nsresult nsHtml5TreeOperation::AppendToDocument(
MOZ_ASSERT(aBuilder);
MOZ_ASSERT(aBuilder->GetDocument() == aNode->OwnerDoc());
MOZ_ASSERT(aBuilder->IsInDocUpdate());
+ if (MOZ_UNLIKELY(aNode->GetParentNode())) {
+ Detach(aNode, aBuilder);
+ if (MOZ_UNLIKELY(aNode->GetParentNode())) {
+ // Can this happen? If it can, give up.
+ return NS_OK;
+ }
+ }
ErrorResult rv;
Document* doc = aBuilder->GetDocument();
@@ -391,6 +406,14 @@ nsresult nsHtml5TreeOperation::FosterParent(nsIContent* aNode,
nsHtml5DocumentBuilder* aBuilder) {
MOZ_ASSERT(aBuilder);
MOZ_ASSERT(aBuilder->IsInDocUpdate());
+ if (MOZ_UNLIKELY(aNode->GetParentNode())) {
+ Detach(aNode, aBuilder);
+ if (MOZ_UNLIKELY(aNode->GetParentNode())) {
+ // Can this happen? If it can, give up.
+ return NS_OK;
+ }
+ }
+
nsIContent* foster = aTable->GetParent();
if (IsElementOrTemplateContent(foster)) {
Loading diff…
References
On This Page