Medium firefox Memory Corruption 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionMemory safety bugs present in Firefox ESR 140.10 and Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentNetworking
Bug ClassMemory Corruption
Tracker1784128
Fix commitc0b6921fae3c (firefox) +6/-2
CISA KEVNot listed
CreditedNika Layzell, Randell Jesup, Timothy Nikkel, Tom Schuster and the Mozilla Fuzzing Team
Disclosed2026-05-19

Changed Functions

FunctionChangeNotes
if
netwerk/base/nsFileStreams.cpp
modified

Files Changed

  • netwerk/base/nsFileStreams.cpp
diff --git a/netwerk/base/nsFileStreams.cpp b/netwerk/base/nsFileStreams.cpp
index 56cf637c922..e407d6c3788 100644
--- a/netwerk/base/nsFileStreams.cpp
+++ b/netwerk/base/nsFileStreams.cpp
@@ -4,6 +4,8 @@
 
 #include "ipc/IPCMessageUtils.h"
 
+#include <algorithm>
+
 #if defined(XP_UNIX)
 #  include <unistd.h>
 #elif defined(XP_WIN)
@@ -196,7 +198,8 @@ nsresult nsFileStreamBase::Read(char* aBuf, uint32_t aCount,
     return rv;
   }
 
-  int32_t bytesRead = PR_Read(mFD, aBuf, aCount);
+  MOZ_ASSERT(aCount <= INT32_MAX);
+  int32_t bytesRead = PR_Read(mFD, aBuf, std::min<uint32_t>(aCount, INT32_MAX));
   if (bytesRead == -1) {
     return NS_ErrorAccordingToNSPR();
   }
@@ -265,7 +268,8 @@ nsresult nsFileStreamBase::Write(const char* buf, uint32_t count,
   nsresult rv = DoPendingOpen();
   NS_ENSURE_SUCCESS(rv, rv);
 
-  int32_t cnt = PR_Write(mFD, buf, count);
+  MOZ_ASSERT(count <= INT32_MAX);
+  int32_t cnt = PR_Write(mFD, buf, std::min<uint32_t>(count, INT32_MAX));
   if (cnt == -1) {
     return NS_ErrorAccordingToNSPR();
   }
Loading diff…