Firefox · DOM
CVE-2026-7321
Sandbox Escape in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/media/webrtc/transport/nricectx.cpp |
modified | |
fordom/media/webrtc/transport/nricectx.cpp |
modified | |
fordom/media/webrtc/transport/nricemediastream.cpp |
modified | |
ifdom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp |
modified | |
ifdom/media/webrtc/transport/third_party/nICEr/src/ice/ice_ctx.cpp |
modified | |
fordom/media/webrtc/transport/third_party/nICEr/src/ice/ice_ctx.cpp |
modified | |
whiledom/media/webrtc/transport/third_party/nICEr/src/ice/ice_ctx.cpp |
modified | |
STAILQ_FOREACH_SAFEdom/media/webrtc/transport/third_party/nICEr/src/ice/ice_ctx.cpp |
modified |
Files Changed
dom/media/webrtc/transport/nricectx.cppdom/media/webrtc/transport/nricemediastream.cppdom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cppdom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate.cppdom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cppdom/media/webrtc/transport/third_party/nICEr/src/ice/ice_component.cppdom/media/webrtc/transport/third_party/nICEr/src/ice/ice_ctx.cppdom/media/webrtc/transport/third_party/nICEr/src/ice/ice_media_stream.cppdom/media/webrtc/transport/third_party/nICEr/src/ice/ice_parser.cppdom/media/webrtc/transport/third_party/nICEr/src/ice/ice_peer_ctx.cppdom/media/webrtc/transport/third_party/nICEr/src/ice/ice_socket.cppdom/media/webrtc/transport/third_party/nICEr/src/net/nr_interface_prioritizer.cppdom/media/webrtc/transport/third_party/nICEr/src/net/nr_resolver.cppdom/media/webrtc/transport/third_party/nICEr/src/net/nr_socket.cppdom/media/webrtc/transport/third_party/nICEr/src/net/nr_socket_multi_tcp.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/addrs-win32.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/addrs.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/nr_socket_buffered_stun.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/nr_socket_turn.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/stun_proc.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/stun_server_ctx.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/turn_client_ctx.cppdom/media/webrtc/transport/third_party/nICEr/src/util/ice_util.cppdom/media/webrtc/transport/third_party/nrappkit/nrappkit.gypdom/media/webrtc/transport/third_party/nrappkit/src/log/r_log.cppdom/media/webrtc/transport/third_party/nrappkit/src/registry/registry.cppdom/media/webrtc/transport/third_party/nrappkit/src/registry/registry.hdom/media/webrtc/transport/third_party/nrappkit/src/registry/registry_local.cppdom/media/webrtc/transport/third_party/nrappkit/src/registry/registrycb.cppdom/media/webrtc/transport/third_party/nrappkit/src/util/libekr/r_assoc.cppdom/media/webrtc/transport/third_party/nrappkit/src/util/libekr/r_data.cppdom/media/webrtc/transport/third_party/nrappkit/src/util/libekr/r_list.cppdom/media/webrtc/transport/third_party/nrappkit/src/util/libekr/r_memory.cppdom/media/webrtc/transport/third_party/nrappkit/src/util/libekr/r_memory.hdom/media/webrtc/transport/third_party/nrappkit/src/util/p_buf.cpp
Patch
diff --git a/dom/media/webrtc/transport/nricectx.cpp b/dom/media/webrtc/transport/nricectx.cpp
index 15530829be3..75f88113846 100644
--- a/dom/media/webrtc/transport/nricectx.cpp
+++ b/dom/media/webrtc/transport/nricectx.cpp
@@ -233,7 +233,7 @@ nsresult NrIceTurnServer::ToNicerTurnStruct(nr_ice_turn_server* server) const {
nsresult rv = ToNicerStunStruct(&server->turn_server);
if (NS_FAILED(rv)) return rv;
- if (!(server->username = r_strdup(username_.c_str())))
+ if (!(server->username = strdup(username_.c_str())))
return NS_ERROR_OUT_OF_MEMORY;
// TODO(ekr@rtfm.com): handle non-ASCII passwords somehow?
@@ -246,7 +246,7 @@ nsresult NrIceTurnServer::ToNicerTurnStruct(nr_ice_turn_server* server) const {
const UCHAR* data = password_.empty() ? nullptr : &password_[0];
int r = r_data_create(&server->password, data, password_.size());
if (r) {
- RFREE(server->username);
+ free(server->username);
return NS_ERROR_OUT_OF_MEMORY;
}
@@ -511,7 +511,7 @@ int NrIceCtx::candidate_error(void* obj, nr_ice_media_stream* stream,
// processing the response. See bug 2018863.
s->SignalCandidateError(s, address, port, url,
static_cast<uint16_t>(candidate->error_code), "");
- RFREE(url);
+ free(url);
return 0;
}
@@ -1006,9 +1006,9 @@ std::vector<std::string> NrIceCtx::GetGlobalAttributes() {
for (int i = 0; i < attrct; i++) {
ret.push_back(std::string(attrs[i]));
- RFREE(attrs[i]);
+ free(attrs[i]);
}
- RFREE(attrs);
+ free(attrs);
return ret;
}
@@ -1140,7 +1140,7 @@ void NrIceCtx::GenerateObfuscatedAddress(nr_ice_candidate* candidate,
obfuscated_host_addresses_[*actual_address] = *mdns_address;
}
- candidate->mdns_addr = r_strdup(mdns_address->c_str());
+ candidate->mdns_addr = strdup(mdns_address->c_str());
}
}
diff --git a/dom/media/webrtc/transport/nricemediastream.cpp b/dom/media/webrtc/transport/nricemediastream.cpp
index 6e6327b3362..a9b73d3bb15 100644
--- a/dom/media/webrtc/transport/nricemediastream.cpp
+++ b/dom/media/webrtc/transport/nricemediastream.cpp
@@ -516,10 +516,10 @@ std::vector<std::string> NrIceMediaStream::GetAttributes() const {
for (int i = 0; i < attrct; i++) {
ret.push_back(attrs[i]);
- RFREE(attrs[i]);
+ free(attrs[i]);
}
- RFREE(attrs);
+ free(attrs);
return ret;
}
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate.cpp
index ce2cf375e6c..402eb887f56 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate.cpp
@@ -175,7 +175,7 @@ int nr_ice_candidate_create(nr_ice_ctx *ctx,nr_ice_component *comp,nr_ice_socket
}
}
- if(!(cand->label=r_strdup(label)))
+ if(!(cand->label=strdup(label)))
ABORT(R_NO_MEMORY);
if(r=nr_ice_get_foundation(ctx,cand))
@@ -223,7 +223,7 @@ int nr_ice_peer_peer_rflx_candidate_create(nr_ice_ctx *ctx, const char *label, n
if(!(cand=R_NEW(nr_ice_candidate)))
ABORT(R_NO_MEMORY);
- if(!(cand->label=r_strdup(label)))
+ if(!(cand->label=strdup(label)))
ABORT(R_NO_MEMORY);
cand->state=NR_ICE_CAND_STATE_INITIALIZED;
@@ -242,7 +242,7 @@ int nr_ice_peer_peer_rflx_candidate_create(nr_ice_ctx *ctx, const char *label, n
if(r=nr_transport_addr_copy(&cand->addr,addr))
ABORT(r);
/* Bogus foundation */
- if(!(cand->foundation=r_strdup(cand->addr.as_string)))
+ if(!(cand->foundation=strdup(cand->addr.as_string)))
ABORT(R_NO_MEMORY);
nr_ice_candidate_compute_codeword(cand);
@@ -354,10 +354,10 @@ int nr_ice_candidate_destroy(nr_ice_candidate **candp)
break;
}
- RFREE(cand->mdns_addr);
- RFREE(cand->foundation);
- RFREE(cand->label);
- RFREE(cand);
+ free(cand->mdns_addr);
+ free(cand->foundation);
+ free(cand->label);
+ free(cand);
return(0);
}
@@ -404,7 +404,7 @@ static int nr_ice_get_foundation(nr_ice_ctx *ctx,nr_ice_candidate *cand)
}
snprintf(fnd,sizeof(fnd),"%d",i);
- if(!(cand->foundation=r_strdup(fnd)))
+ if(!(cand->foundation=strdup(fnd)))
ABORT(R_NO_MEMORY);
return(0);
@@ -423,7 +423,7 @@ static int nr_ice_get_foundation(nr_ice_ctx *ctx,nr_ice_candidate *cand)
STAILQ_INSERT_TAIL(&ctx->foundations,foundation,entry);
snprintf(fnd,sizeof(fnd),"%d",i);
- if(!(cand->foundation=r_strdup(fnd)))
+ if(!(cand->foundation=strdup(fnd)))
ABORT(R_NO_MEMORY);
_status=0;
@@ -997,7 +997,7 @@ static void nr_ice_turn_allocated_cb(NR_SOCKET s, int how, void *cb_arg)
r_log(LOG_ICE,LOG_DEBUG,"ICE(%s)/CAND(%s): new relay base=%s addr=%s", cand->ctx->label, cand->label, cand->base.as_string, cand->addr.as_string);
- RFREE(cand->label);
+ free(cand->label);
cand->label=label;
nr_ice_candidate_mark_done(cand, NR_ICE_CAND_STATE_INITIALIZED);
cand = 0;
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp
index 59f9f855a8b..a5878a71815 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp
@@ -143,7 +143,7 @@ int nr_ice_candidate_pair_create(nr_ice_peer_ctx *pctx, nr_ice_candidate *lcand,
&rcand->addr, RTO, flags,
&pair->stun_client))
ABORT(r);
- if(!(pair->stun_client->params.ice_binding_request.username=r_strdup(rcand->stream->l2r_user)))
+ if(!(pair->stun_client->params.ice_binding_request.username=strdup(rcand->stream->l2r_user)))
ABORT(R_NO_MEMORY);
if(r=r_data_copy(&pair->stun_client->params.ice_binding_request.password,
&rcand->stream->l2r_pass))
@@ -180,12 +180,12 @@ int nr_ice_candidate_pair_destroy(nr_ice_cand_pair **pairp)
nr_accumulate_count(&(pair->local->ctx->stats.stun_retransmits), pair->stun_client->retransmit_ct);
}
- RFREE(pair->as_string);
- RFREE(pair->foundation);
+ free(pair->as_string);
+ free(pair->foundation);
nr_ice_socket_deregister(pair->local->isock,pair->stun_client_handle);
if (pair->stun_client) {
- RFREE(pair->stun_client->params.ice_binding_request.username);
- RFREE(pair->stun_client->params.ice_binding_request.password.data);
+ free(pair->stun_client->params.ice_binding_request.username);
+ free(pair->stun_client->params.ice_binding_request.password.data);
nr_stun_client_ctx_destroy(&pair->stun_client);
}
@@ -193,7 +193,7 @@ int nr_ice_candidate_pair_destroy(nr_ice_cand_pair **pairp)
NR_async_timer_cancel(pair->restart_role_change_cb_timer);
NR_async_timer_cancel(pair->restart_nominated_cb_timer);
- RFREE(pair);
+ free(pair);
return(0);
}
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_component.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_component.cpp
index d13150ebe6e..814192d7b4c 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_component.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_component.cpp
@@ -74,7 +74,7 @@ static int nr_ice_pre_answer_request_create(nr_transport_addr *dst, nr_stun_serv
ABORT(r);
if (!nr_stun_message_has_attribute(par->req.request, NR_STUN_ATTR_USERNAME, &attr))
ABORT(R_INTERNAL);
- if (!(par->username = r_strdup(attr->u.username)))
+ if (!(par->username = strdup(attr->u.username)))
ABORT(R_NO_MEMORY);
*parp=par;
@@ -102,8 +102,8 @@ static int nr_ice_pre_answer_request_destroy(nr_ice_pre_answer_request **parp)
nr_stun_message_destroy(&par->req.request);
nr_stun_message_destroy(&par->req.response);
- RFREE(par->username);
- RFREE(par);
+ free(par->username);
+ free(par);
return(0);
}
@@ -173,7 +173,7 @@ int nr_ice_component_destroy(nr_ice_component **componentp)
nr_ice_pre_answer_request_destroy(&r1);
}
- RFREE(component);
+ free(component);
return(0);
}
@@ -1698,7 +1698,7 @@ int nr_ice_component_select_pair(nr_ice_peer_ctx *pctx, nr_ice_component *comp)
_status=0;
abort:
- RFREE(pairs);
+ free(pairs);
return(_status);
}
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_ctx.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_ctx.cpp
index d574a923533..98464bdc42d 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_ctx.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_ctx.cpp
@@ -104,7 +104,7 @@ int nr_ice_fetch_stun_servers(int ct, nr_ice_stun_server **out)
if (r = nr_ip4_port_to_transport_addr(ntohl(addr_int), port, IPPROTO_UDP,
&servers[i].addr))
ABORT(r);
- RFREE(addr);
+ free(addr);
addr=0;
}
@@ -112,8 +112,8 @@ int nr_ice_fetch_stun_servers(int ct, nr_ice_stun_server **out)
_status=0;
abort:
- RFREE(addr);
- if (_status) RFREE(servers);
+ free(addr);
+ if (_status) free(servers);
return(_status);
}
@@ -122,7 +122,7 @@ int nr_ice_ctx_set_stun_servers(nr_ice_ctx *ctx,nr_ice_stun_server *servers,int
int _status;
if(ctx->stun_servers_cfg){
- RFREE(ctx->stun_servers_cfg);
+ free(ctx->stun_servers_cfg);
ctx->stun_servers_cfg=NULL;
ctx->stun_server_ct_cfg=0;
}
@@ -146,10 +146,10 @@ int nr_ice_ctx_set_turn_servers(nr_ice_ctx *ctx,nr_ice_turn_server *servers,int
if(ctx->turn_servers_cfg){
for (int i = 0; i < ctx->turn_server_ct_cfg; i++) {
- RFREE(ctx->turn_servers_cfg[i].username);
+ free(ctx->turn_servers_cfg[i].username);
r_data_destroy(&ctx->turn_servers_cfg[i].password);
}
- RFREE(ctx->turn_servers_cfg);
+ free(ctx->turn_servers_cfg);
ctx->turn_servers_cfg=NULL;
ctx->turn_server_ct_cfg=0;
}
@@ -172,7 +172,7 @@ static int nr_ice_ctx_set_local_addrs(nr_ice_ctx *ctx,nr_local_addr *addrs,int c
int _status,i,r;
if(ctx->local_addrs) {
- RFREE(ctx->local_addrs);
+ free(ctx->local_addrs);
ctx->local_addr_ct=0;
ctx->local_addrs=0;
}
@@ -284,7 +284,7 @@ int nr_ice_fetch_turn_servers(int ct, nr_ice_turn_server **out)
data.data=0;
}
- RFREE(addr);
+ free(addr);
addr=0;
}
@@ -292,9 +292,9 @@ int nr_ice_fetch_turn_servers(int ct, nr_ice_turn_server **out)
_status=0;
abort:
- RFREE(data.data);
- RFREE(addr);
- if (_status) RFREE(servers);
+ free(data.data);
+ free(addr);
+ if (_status) free(servers);
return(_status);
}
#endif /* USE_TURN */
@@ -314,7 +314,7 @@ int nr_ice_fetch_turn_servers(int ct, nr_ice_turn_server **out)
ctx->flags=flags;
- if(!(ctx->label=r_strdup(label)))
+ if(!(ctx->label=strdup(label)))
ABORT(R_NO_MEMORY);
ctx->gather_handler = gather_handler;
@@ -428,39 +428,39 @@ int nr_ice_fetch_turn_servers(int ct, nr_ice_turn_server **out)
nr_ice_media_stream_destroy(&s1);
}
- RFREE(ctx->label);
+ free(ctx->label);
ctx->gather_handler = 0;
- RFREE(ctx->stun_servers_cfg);
+ free(ctx->stun_servers_cfg);
- RFREE(ctx->local_addrs);
+ free(ctx->local_addrs);
- RFREE(ctx->target_for_default_local_address_lookup);
+ free(ctx->target_for_default_local_address_lookup);
for (i = 0; i < ctx->turn_server_ct_cfg; i++) {
- RFREE(ctx->turn_servers_cfg[i].username);
+ free(ctx->turn_servers_cfg[i].username);
r_data_destroy(&ctx->turn_servers_cfg[i].password);
}
- RFREE(ctx->turn_servers_cfg);
+ free(ctx->turn_servers_cfg);
f1=STAILQ_FIRST(&ctx->foundations);
while(f1){
f2=STAILQ_NEXT(f1,entry);
- RFREE(f1);
+ free(f1);
f1=f2;
}
STAILQ_FOREACH_SAFE(id1, &ctx->ids, entry, id2){
STAILQ_REMOVE(&ctx->ids,id1,nr_ice_stun_id_,entry);
- RFREE(id1);
+ free(id1);
}
nr_resolver_destroy(&ctx->resolver);
nr_interface_prioritizer_destroy(&ctx->interface_prioritizer);
nr_socket_factory_destroy(&ctx->socket_factory);
- RFREE(ctx);
+ free(ctx);
*ctxp=0;
}
@@ -820,7 +820,7 @@ int nr_ice_set_target_for_default_local_address_lookup(nr_ice_ctx *ctx, const ch
int r,_status;
if (ctx->target_for_default_local_address_lookup) {
- RFREE(ctx->target_for_default_local_address_lookup);
+ free(ctx->target_for_default_local_address_lookup);
ctx->target_for_default_local_address_lookup=0;
}
@@ -828,7 +828,7 @@ int nr_ice_set_target_for_default_local_address_lookup(nr_ice_ctx *ctx, const ch
ABORT(R_NO_MEMORY);
if ((r=nr_str_port_to_transport_addr(target_ip, target_port, IPPROTO_UDP, ctx->target_for_default_local_address_lookup))) {
- RFREE(ctx->target_for_default_local_address_lookup);
+ free(ctx->target_for_default_local_address_lookup);
ctx->target_for_default_local_address_lookup=0;
ABORT(r);
}
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_media_stream.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_media_stream.cpp
index 5fa4cb60267..c3840bc2c6f 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_media_stream.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_media_stream.cpp
@@ -54,13 +54,13 @@ int nr_ice_media_stream_create(nr_ice_ctx *ctx,const char *label,const char *ufr
if(!(stream=R_NEW(nr_ice_media_stream)))
ABORT(R_NO_MEMORY);
- if(!(stream->label=r_strdup(label)))
+ if(!(stream->label=strdup(label)))
ABORT(R_NO_MEMORY);
- if(!(stream->ufrag=r_strdup(ufrag)))
+ if(!(stream->ufrag=strdup(ufrag)))
ABORT(R_NO_MEMORY);
- if(!(stream->pwd=r_strdup(pwd)))
+ if(!(stream->pwd=strdup(pwd)))
ABORT(R_NO_MEMORY);
stream->ctx=ctx;
@@ -100,7 +100,7 @@ int nr_ice_media_stream_create(nr_ice_ctx *ctx,const char *label,const char *ufr
nr_ice_turn_server *dst = &stream->turn_servers[i];
nr_ice_turn_server *src = &ctx->turn_servers_cfg[i];
... (file diff truncated)
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp b/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp
index 802af224249..a3e64200dba 100644
--- a/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp
+++ b/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp
@@ -143,9 +143,9 @@ class IcePeer {
for (int i = 0; i < attrct; i++) {
ret.push_back(std::string(attrs[i]));
- RFREE(attrs[i]);
+ free(attrs[i]);
}
- RFREE(attrs);
+ free(attrs);
return ret;
}
@@ -166,9 +166,9 @@ class IcePeer {
for (int i = 0; i < attrct; i++) {
ret.push_back(std::string(attrs[i]));
- RFREE(attrs[i]);
+ free(attrs[i]);
}
- RFREE(attrs);
+ free(attrs);
return ret;
}
Loading diff…
References
On This Page