Firefox · DOM
CVE-2026-3847
Memory Corruption in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/cache/BoundStorageKeyParent.cppdom/cache/BoundStorageKeyParent.h
Patch
diff --git a/dom/cache/BoundStorageKeyParent.cpp b/dom/cache/BoundStorageKeyParent.cpp
index 8ed76e83d60..4caafc9f514 100644
--- a/dom/cache/BoundStorageKeyParent.cpp
+++ b/dom/cache/BoundStorageKeyParent.cpp
@@ -9,17 +9,30 @@
#include "mozilla/dom/cache/ActorUtils.h"
#include "mozilla/dom/cache/PCacheStorageParent.h"
#include "mozilla/dom/quota/PrincipalUtils.h"
+#include "mozilla/ipc/PBackgroundParent.h"
namespace mozilla::dom::cache {
using mozilla::ipc::PBackgroundParent;
using mozilla::ipc::PrincipalInfo;
+BoundStorageKeyParent::BoundStorageKeyParent(
+ PBackgroundParent* aBackgroundParent)
+ : mBackgroundParent(aBackgroundParent) {
+ MOZ_COUNT_CTOR(BoundStorageKeyParent);
+}
+
+BoundStorageKeyParent::~BoundStorageKeyParent() {
+ MOZ_COUNT_DTOR(BoundStorageKeyParent);
+}
+
// declared in ActorUtils.h
already_AddRefed<dom::cache::PCacheStorageParent>
BoundStorageKeyParent::AllocPCacheStorageParent(
const Namespace& aNamespace, const PrincipalInfo& aPrincipalInfo) {
- MOZ_ASSERT(mBackgroundParent);
+ if (!mBackgroundParent || !mBackgroundParent->CanSend()) {
+ return nullptr;
+ }
return dom::cache::AllocPCacheStorageParent(mBackgroundParent, this,
aNamespace, aPrincipalInfo);
}
diff --git a/dom/cache/BoundStorageKeyParent.h b/dom/cache/BoundStorageKeyParent.h
index a0ed96fd628..98df75e19b6 100644
--- a/dom/cache/BoundStorageKeyParent.h
+++ b/dom/cache/BoundStorageKeyParent.h
@@ -25,25 +25,17 @@ class BoundStorageKeyParent final : public PBoundStorageKeyParent {
public:
explicit BoundStorageKeyParent(
- mozilla::ipc::PBackgroundParent* aBackgroundParent)
- : mBackgroundParent(aBackgroundParent) {
- MOZ_COUNT_CTOR(BoundStorageKeyParent);
- }
+ mozilla::ipc::PBackgroundParent* aBackgroundParent);
NS_INLINE_DECL_REFCOUNTING(BoundStorageKeyParent, override)
private:
- virtual ~BoundStorageKeyParent() { MOZ_COUNT_DTOR(BoundStorageKeyParent); }
+ ~BoundStorageKeyParent() override;
already_AddRefed<PCacheStorageParent> AllocPCacheStorageParent(
const Namespace& aNamespace, const PrincipalInfo& aPrincipalInfo);
- // Keeping a reference to PBackgroundParent actor as it is required to passed
- // in when creating CacheStorageParent in AllocPCacheStorageParent. Raw ptr is
- // fine here as PBackground is one of the few top-level that gets created very
- // early on in the content and parent lifecycle and extends the lifetime of
- // this class.
- mozilla::ipc::PBackgroundParent* MOZ_NON_OWNING_REF mBackgroundParent;
+ RefPtr<mozilla::ipc::PBackgroundParent> mBackgroundParent;
};
} // namespace dom::cache
Loading diff…
References
On This Page