Firefox · DOM
CVE-2026-7321
Sandbox Escape in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/media/webrtc/transport/nricectx.cpp |
modified | |
fordom/media/webrtc/transport/nricectx.cpp |
modified | |
fordom/media/webrtc/transport/nricemediastream.cpp |
modified | |
fordom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp |
modified | |
ifdom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp |
modified |
Files Changed
dom/media/webrtc/transport/nricectx.cppdom/media/webrtc/transport/nricemediastream.cppdom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cppdom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate.cppdom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cppdom/media/webrtc/transport/third_party/nICEr/src/ice/ice_component.cppdom/media/webrtc/transport/third_party/nICEr/src/ice/ice_ctx.cppdom/media/webrtc/transport/third_party/nICEr/src/ice/ice_media_stream.cppdom/media/webrtc/transport/third_party/nICEr/src/ice/ice_parser.cppdom/media/webrtc/transport/third_party/nICEr/src/ice/ice_peer_ctx.cppdom/media/webrtc/transport/third_party/nICEr/src/ice/ice_socket.cppdom/media/webrtc/transport/third_party/nICEr/src/net/nr_interface_prioritizer.cppdom/media/webrtc/transport/third_party/nICEr/src/net/nr_resolver.cppdom/media/webrtc/transport/third_party/nICEr/src/net/nr_socket.cppdom/media/webrtc/transport/third_party/nICEr/src/net/nr_socket_multi_tcp.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/addrs-win32.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/addrs.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/nr_socket_buffered_stun.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/nr_socket_turn.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/stun_proc.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/stun_server_ctx.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/turn_client_ctx.cppdom/media/webrtc/transport/third_party/nICEr/src/util/ice_util.cppdom/media/webrtc/transport/third_party/nrappkit/nrappkit.gypdom/media/webrtc/transport/third_party/nrappkit/src/log/r_log.cppdom/media/webrtc/transport/third_party/nrappkit/src/registry/registry.cppdom/media/webrtc/transport/third_party/nrappkit/src/registry/registry.hdom/media/webrtc/transport/third_party/nrappkit/src/registry/registry_local.cppdom/media/webrtc/transport/third_party/nrappkit/src/registry/registrycb.cppdom/media/webrtc/transport/third_party/nrappkit/src/util/libekr/r_assoc.cppdom/media/webrtc/transport/third_party/nrappkit/src/util/libekr/r_data.cppdom/media/webrtc/transport/third_party/nrappkit/src/util/libekr/r_list.cppdom/media/webrtc/transport/third_party/nrappkit/src/util/libekr/r_memory.cppdom/media/webrtc/transport/third_party/nrappkit/src/util/libekr/r_memory.hdom/media/webrtc/transport/third_party/nrappkit/src/util/p_buf.cpp
Patch
diff --git a/dom/media/webrtc/transport/nricectx.cpp b/dom/media/webrtc/transport/nricectx.cpp
index 15530829be3..75f88113846 100644
--- a/dom/media/webrtc/transport/nricectx.cpp
+++ b/dom/media/webrtc/transport/nricectx.cpp
@@ -233,7 +233,7 @@ nsresult NrIceTurnServer::ToNicerTurnStruct(nr_ice_turn_server* server) const {
nsresult rv = ToNicerStunStruct(&server->turn_server);
if (NS_FAILED(rv)) return rv;
- if (!(server->username = r_strdup(username_.c_str())))
+ if (!(server->username = strdup(username_.c_str())))
return NS_ERROR_OUT_OF_MEMORY;
// TODO(ekr@rtfm.com): handle non-ASCII passwords somehow?
@@ -246,7 +246,7 @@ nsresult NrIceTurnServer::ToNicerTurnStruct(nr_ice_turn_server* server) const {
const UCHAR* data = password_.empty() ? nullptr : &password_[0];
int r = r_data_create(&server->password, data, password_.size());
if (r) {
- RFREE(server->username);
+ free(server->username);
return NS_ERROR_OUT_OF_MEMORY;
}
@@ -511,7 +511,7 @@ int NrIceCtx::candidate_error(void* obj, nr_ice_media_stream* stream,
// processing the response. See bug 2018863.
s->SignalCandidateError(s, address, port, url,
static_cast<uint16_t>(candidate->error_code), "");
- RFREE(url);
+ free(url);
return 0;
}
@@ -1006,9 +1006,9 @@ std::vector<std::string> NrIceCtx::GetGlobalAttributes() {
for (int i = 0; i < attrct; i++) {
ret.push_back(std::string(attrs[i]));
- RFREE(attrs[i]);
+ free(attrs[i]);
}
- RFREE(attrs);
+ free(attrs);
return ret;
}
@@ -1140,7 +1140,7 @@ void NrIceCtx::GenerateObfuscatedAddress(nr_ice_candidate* candidate,
obfuscated_host_addresses_[*actual_address] = *mdns_address;
}
- candidate->mdns_addr = r_strdup(mdns_address->c_str());
+ candidate->mdns_addr = strdup(mdns_address->c_str());
}
}
diff --git a/dom/media/webrtc/transport/nricemediastream.cpp b/dom/media/webrtc/transport/nricemediastream.cpp
index 6e6327b3362..a9b73d3bb15 100644
--- a/dom/media/webrtc/transport/nricemediastream.cpp
+++ b/dom/media/webrtc/transport/nricemediastream.cpp
@@ -516,10 +516,10 @@ std::vector<std::string> NrIceMediaStream::GetAttributes() const {
for (int i = 0; i < attrct; i++) {
ret.push_back(attrs[i]);
- RFREE(attrs[i]);
+ free(attrs[i]);
}
- RFREE(attrs);
+ free(attrs);
return ret;
}
diff --git a/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp b/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp
index 802af224249..a3e64200dba 100644
--- a/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp
+++ b/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp
@@ -143,9 +143,9 @@ class IcePeer {
for (int i = 0; i < attrct; i++) {
ret.push_back(std::string(attrs[i]));
- RFREE(attrs[i]);
+ free(attrs[i]);
}
- RFREE(attrs);
+ free(attrs);
return ret;
}
@@ -166,9 +166,9 @@ class IcePeer {
for (int i = 0; i < attrct; i++) {
ret.push_back(std::string(attrs[i]));
- RFREE(attrs[i]);
+ free(attrs[i]);
}
- RFREE(attrs);
+ free(attrs);
return ret;
}
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate.cpp
index ce2cf375e6c..402eb887f56 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate.cpp
@@ -175,7 +175,7 @@ int nr_ice_candidate_create(nr_ice_ctx *ctx,nr_ice_component *comp,nr_ice_socket
}
}
- if(!(cand->label=r_strdup(label)))
+ if(!(cand->label=strdup(label)))
ABORT(R_NO_MEMORY);
if(r=nr_ice_get_foundation(ctx,cand))
@@ -223,7 +223,7 @@ int nr_ice_peer_peer_rflx_candidate_create(nr_ice_ctx *ctx, const char *label, n
if(!(cand=R_NEW(nr_ice_candidate)))
ABORT(R_NO_MEMORY);
- if(!(cand->label=r_strdup(label)))
+ if(!(cand->label=strdup(label)))
ABORT(R_NO_MEMORY);
cand->state=NR_ICE_CAND_STATE_INITIALIZED;
@@ -242,7 +242,7 @@ int nr_ice_peer_peer_rflx_candidate_create(nr_ice_ctx *ctx, const char *label, n
if(r=nr_transport_addr_copy(&cand->addr,addr))
ABORT(r);
/* Bogus foundation */
- if(!(cand->foundation=r_strdup(cand->addr.as_string)))
+ if(!(cand->foundation=strdup(cand->addr.as_string)))
ABORT(R_NO_MEMORY);
nr_ice_candidate_compute_codeword(cand);
@@ -354,10 +354,10 @@ int nr_ice_candidate_destroy(nr_ice_candidate **candp)
break;
}
- RFREE(cand->mdns_addr);
- RFREE(cand->foundation);
- RFREE(cand->label);
- RFREE(cand);
+ free(cand->mdns_addr);
+ free(cand->foundation);
+ free(cand->label);
+ free(cand);
return(0);
}
@@ -404,7 +404,7 @@ static int nr_ice_get_foundation(nr_ice_ctx *ctx,nr_ice_candidate *cand)
}
snprintf(fnd,sizeof(fnd),"%d",i);
- if(!(cand->foundation=r_strdup(fnd)))
+ if(!(cand->foundation=strdup(fnd)))
ABORT(R_NO_MEMORY);
return(0);
@@ -423,7 +423,7 @@ static int nr_ice_get_foundation(nr_ice_ctx *ctx,nr_ice_candidate *cand)
STAILQ_INSERT_TAIL(&ctx->foundations,foundation,entry);
snprintf(fnd,sizeof(fnd),"%d",i);
- if(!(cand->foundation=r_strdup(fnd)))
+ if(!(cand->foundation=strdup(fnd)))
ABORT(R_NO_MEMORY);
_status=0;
@@ -997,7 +997,7 @@ static void nr_ice_turn_allocated_cb(NR_SOCKET s, int how, void *cb_arg)
r_log(LOG_ICE,LOG_DEBUG,"ICE(%s)/CAND(%s): new relay base=%s addr=%s", cand->ctx->label, cand->label, cand->base.as_string, cand->addr.as_string);
- RFREE(cand->label);
+ free(cand->label);
cand->label=label;
nr_ice_candidate_mark_done(cand, NR_ICE_CAND_STATE_INITIALIZED);
cand = 0;
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp
index 59f9f855a8b..a5878a71815 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp
@@ -143,7 +143,7 @@ int nr_ice_candidate_pair_create(nr_ice_peer_ctx *pctx, nr_ice_candidate *lcand,
&rcand->addr, RTO, flags,
&pair->stun_client))
ABORT(r);
- if(!(pair->stun_client->params.ice_binding_request.username=r_strdup(rcand->stream->l2r_user)))
+ if(!(pair->stun_client->params.ice_binding_request.username=strdup(rcand->stream->l2r_user)))
ABORT(R_NO_MEMORY);
if(r=r_data_copy(&pair->stun_client->params.ice_binding_request.password,
&rcand->stream->l2r_pass))
@@ -180,12 +180,12 @@ int nr_ice_candidate_pair_destroy(nr_ice_cand_pair **pairp)
nr_accumulate_count(&(pair->local->ctx->stats.stun_retransmits), pair->stun_client->retransmit_ct);
}
- RFREE(pair->as_string);
- RFREE(pair->foundation);
+ free(pair->as_string);
+ free(pair->foundation);
nr_ice_socket_deregister(pair->local->isock,pair->stun_client_handle);
if (pair->stun_client) {
- RFREE(pair->stun_client->params.ice_binding_request.username);
- RFREE(pair->stun_client->params.ice_binding_request.password.data);
+ free(pair->stun_client->params.ice_binding_request.username);
+ free(pair->stun_client->params.ice_binding_request.password.data);
nr_stun_client_ctx_destroy(&pair->stun_client);
}
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp b/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp
index 802af224249..a3e64200dba 100644
--- a/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp
+++ b/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp
@@ -143,9 +143,9 @@ class IcePeer {
for (int i = 0; i < attrct; i++) {
ret.push_back(std::string(attrs[i]));
- RFREE(attrs[i]);
+ free(attrs[i]);
}
- RFREE(attrs);
+ free(attrs);
return ret;
}
@@ -166,9 +166,9 @@ class IcePeer {
for (int i = 0; i < attrct; i++) {
ret.push_back(std::string(attrs[i]));
- RFREE(attrs[i]);
+ free(attrs[i]);
}
- RFREE(attrs);
+ free(attrs);
return ret;
}
Loading diff…
References
On This Page