High firefox Memory Corruption 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionMemory safety bugs present in Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentDOM
Bug ClassMemory Corruption
Tracker1944033
Fix commit01d56417ef9c (firefox) +32/-9
CISA KEVNot listed
CreditedChristian Holler, Fatih Kilic, Tom Schuster and the Mozilla Fuzzing Team
Disclosed2026-03-24

Changed Functions

FunctionChangeNotes
for
dom/media/mediasession/MediaMetadata.cpp
modified
MediaImageData
dom/media/mediasession/MediaMetadata.h
modified
MediaMetadataBase
dom/media/mediasession/MediaMetadata.h
modified
MediaMetadata
dom/media/mediasession/MediaMetadata.h
modified

Files Changed

  • dom/media/mediasession/MediaMetadata.cpp
  • dom/media/mediasession/MediaMetadata.h
  • dom/media/mediasession/MediaSessionIPCUtils.h
diff --git a/dom/media/mediasession/MediaMetadata.cpp b/dom/media/mediasession/MediaMetadata.cpp
index bd2fb439883..d74622536ef 100644
--- a/dom/media/mediasession/MediaMetadata.cpp
+++ b/dom/media/mediasession/MediaMetadata.cpp
@@ -14,6 +14,14 @@
 
 namespace mozilla::dom {
 
+MediaImage MediaImageData::ToMediaImage() const {
+  MediaImage image;
+  image.mSizes = mSizes;
+  image.mSrc = mSrc;
+  image.mType = mType;
+  return image;
+}
+
 // Only needed for refcounted objects.
 NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(MediaMetadata, mParent)
 NS_IMPL_CYCLE_COLLECTING_ADDREF(MediaMetadata)
@@ -73,7 +81,7 @@ void MediaMetadata::GetArtwork(JSContext* aCx, nsTArray<JSObject*>& aRetVal,
 
   for (size_t i = 0; i < mArtwork.Length(); ++i) {
     JS::Rooted<JS::Value> value(aCx);
-    if (!ToJSValue(aCx, mArtwork[i], &value)) {
+    if (!ToJSValue(aCx, mArtwork[i].ToMediaImage(), &value)) {
       aRv.NoteJSContextException(aCx);
       return;
     }
@@ -138,17 +146,19 @@ static nsresult ResolveURL(nsString& aURL, nsIURI* aBaseURI) {
 
 void MediaMetadata::SetArtworkInternal(const Sequence<MediaImage>& aArtwork,
                                        ErrorResult& aRv) {
-  nsTArray<MediaImage> artwork;
-  artwork.Assign(aArtwork);
-
   nsCOMPtr<nsIURI> baseURI = GetEntryBaseURL();
-  for (MediaImage& image : artwork) {
-    nsresult rv = ResolveURL(image.mSrc, baseURI);
+
+  nsTArray<MediaImageData> artwork;
+  for (const MediaImage& image : aArtwork) {
+    MediaImageData imageData(image);
+    nsresult rv = ResolveURL(imageData.mSrc, baseURI);
     if (NS_WARN_IF(NS_FAILED(rv))) {
       aRv.ThrowTypeError<MSG_INVALID_URL>(NS_ConvertUTF16toUTF8(image.mSrc));
       return;
     }
+    artwork.AppendElement(std::move(imageData));
   }
+
   mArtwork = std::move(artwork);
 }
 
diff --git a/dom/media/mediasession/MediaMetadata.h b/dom/media/mediasession/MediaMetadata.h
index 8687d40624b..c24cf20e60b 100644
--- a/dom/media/mediasession/MediaMetadata.h
+++ b/dom/media/mediasession/MediaMetadata.h
@@ -20,6 +20,19 @@ class ErrorResult;
 
 namespace dom {
 
+class MediaImageData {
+ public:
+  MediaImageData() = default;
+  explicit MediaImageData(const MediaImage& aImage)
+      : mSizes(aImage.mSizes), mSrc(aImage.mSrc), mType(aImage.mType) {}
+
+  MediaImage ToMediaImage() const;
+
+  nsString mSizes;
+  nsString mSrc;
+  nsString mType;
+};
+
 class MediaMetadataBase {
  public:
   MediaMetadataBase() = default;
@@ -33,7 +46,7 @@ class MediaMetadataBase {
   nsString mArtist;
   nsString mAlbum;
   nsCString mUrl;
-  CopyableTArray<MediaImage> mArtwork;
+  CopyableTArray<MediaImageData> mArtwork;
 };
 
 class MediaMetadata final : public nsISupports,
diff --git a/dom/media/mediasession/MediaSessionIPCUtils.h b/dom/media/mediasession/MediaSessionIPCUtils.h
index 5a20da73820..e13f116b458 100644
--- a/dom/media/mediasession/MediaSessionIPCUtils.h
+++ b/dom/media/mediasession/MediaSessionIPCUtils.h
@@ -23,8 +23,8 @@ typedef Maybe<MediaMetadataBase> MaybeMediaMetadataBase;
 namespace IPC {
 
 template <>
-struct ParamTraits<mozilla::dom::MediaImage> {
-  typedef mozilla::dom::MediaImage paramType;
+struct ParamTraits<mozilla::dom::MediaImageData> {
+  typedef mozilla::dom::MediaImageData paramType;
 
   static void Write(MessageWriter* aWriter, const paramType& aParam) {
     WriteParam(aWriter, aParam.mSizes);
Loading diff…