Firefox · Core
CVE-2026-2779
Logic Error in Core
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifmozglue/misc/MmapFaultHandler.h |
modified |
Files Changed
mozglue/misc/MmapFaultHandler.cppmozglue/misc/MmapFaultHandler.h
Patch
diff --git a/mozglue/misc/MmapFaultHandler.cpp b/mozglue/misc/MmapFaultHandler.cpp
index a73b9bd24b7..747491bc887 100644
--- a/mozglue/misc/MmapFaultHandler.cpp
+++ b/mozglue/misc/MmapFaultHandler.cpp
@@ -24,10 +24,6 @@ static void MmapSIGBUSHandler(int signum, siginfo_t* info, void* context) {
MmapAccessScope* mas = sMmapAccessScope.get();
if (mas && mas->IsInsideBuffer(info->si_addr)) {
- // Temporarily instead of handling the signal, we crash intentionally and
- // send some diagnostic information to find out why the signal is received.
- mas->CrashWithInfo(info->si_addr);
-
// The address is inside the buffer, handle the failure.
siglongjmp(mas->mJmpBuf, signum);
}
diff --git a/mozglue/misc/MmapFaultHandler.h b/mozglue/misc/MmapFaultHandler.h
index fca356921c7..485b74385aa 100644
--- a/mozglue/misc/MmapFaultHandler.h
+++ b/mozglue/misc/MmapFaultHandler.h
@@ -78,23 +78,23 @@ inline bool ValidFD(T fd) {
return !!fd;
}
-# define MMAP_FAULT_HANDLER_BEGIN_HANDLE(fd) \
- { \
- void* mmapScopeBuf = nullptr; \
- nsCString mmapScopeFilename; \
- uint32_t mmapScopeBufLen = 0; \
- if (ValidFD(fd) && fd->mMap) { \
- mmapScopeBuf = (void*)fd->mFileStart; \
- mmapScopeBufLen = fd->mTotalLen; \
- } \
- if (ValidFD(fd) && fd->mFile) { \
- nsCOMPtr<nsIFile> file = fd->mFile.GetBaseFile(); \
- if (file) { \
- file->GetNativeLeafName(mmapScopeFilename); \
- } \
- } \
- MmapAccessScope mmapScope(mmapScopeBuf, mmapScopeBufLen, \
- mmapScopeFilename.get()); \
+# define MMAP_FAULT_HANDLER_BEGIN_HANDLE(fd) \
+ { \
+ void* mmapScopeBuf = nullptr; \
+ nsCString mmapScopeFilename; \
+ uint32_t mmapScopeBufLen = 0; \
+ if (ValidFD(fd) && fd->mFileStart && fd->mTotalLen > 0) { \
+ mmapScopeBuf = (void*)fd->mFileStart; \
+ mmapScopeBufLen = fd->mTotalLen; \
+ } \
+ if (ValidFD(fd) && fd->mFile) { \
+ nsCOMPtr<nsIFile> file = fd->mFile.GetBaseFile(); \
+ if (file) { \
+ file->GetNativeLeafName(mmapScopeFilename); \
+ } \
+ } \
+ MmapAccessScope mmapScope(mmapScopeBuf, mmapScopeBufLen, \
+ mmapScopeFilename.get()); \
if (sigsetjmp(mmapScope.mJmpBuf, 0) == 0) {
# define MMAP_FAULT_HANDLER_BEGIN_BUFFER(buf, bufLen) \
{ \
Loading diff…
References
On This Page