Firefox · DOM
CVE-2026-6776
Logic Error in DOM
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/media/webrtc/transport/third_party/nICEr/src/net/transport_addr.cpp |
modified |
Files Changed
dom/media/webrtc/transport/nr_socket_prsock.cppdom/media/webrtc/transport/third_party/nICEr/src/net/transport_addr.cpp
Patch
diff --git a/dom/media/webrtc/transport/nr_socket_prsock.cpp b/dom/media/webrtc/transport/nr_socket_prsock.cpp
index 5e9a9d03366..fd0eeee8170 100644
--- a/dom/media/webrtc/transport/nr_socket_prsock.cpp
+++ b/dom/media/webrtc/transport/nr_socket_prsock.cpp
@@ -528,7 +528,7 @@ abort:
int nr_transport_addr_get_addrstring_and_port(const nr_transport_addr* addr,
nsACString* host, int32_t* port) {
int r, _status;
- char addr_string[64];
+ char addr_string[256];
// We cannot directly use |nr_transport_addr.as_string| because it contains
// more than ip address, therefore, we need to explicity convert it
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/net/transport_addr.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/net/transport_addr.cpp
index efedb3782aa..265c38f36c9 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/net/transport_addr.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/net/transport_addr.cpp
@@ -281,6 +281,9 @@ int nr_transport_addr_get_addrstring(const nr_transport_addr *addr, char *str, i
int _status;
if (addr->fqdn[0]) {
+ if (maxlen <= strlen(addr->fqdn)) {
+ ABORT(R_BAD_ARGS);
+ }
strncpy(str, addr->fqdn, maxlen);
} else {
const char* res;
Loading diff…
References
On This Page