Firefox · Networking
CVE-2026-8974
Memory Corruption in Networking
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifnetwerk/base/nsFileStreams.cpp |
modified |
Files Changed
netwerk/base/nsFileStreams.cpp
Patch
diff --git a/netwerk/base/nsFileStreams.cpp b/netwerk/base/nsFileStreams.cpp
index 56cf637c922..e407d6c3788 100644
--- a/netwerk/base/nsFileStreams.cpp
+++ b/netwerk/base/nsFileStreams.cpp
@@ -4,6 +4,8 @@
#include "ipc/IPCMessageUtils.h"
+#include <algorithm>
+
#if defined(XP_UNIX)
# include <unistd.h>
#elif defined(XP_WIN)
@@ -196,7 +198,8 @@ nsresult nsFileStreamBase::Read(char* aBuf, uint32_t aCount,
return rv;
}
- int32_t bytesRead = PR_Read(mFD, aBuf, aCount);
+ MOZ_ASSERT(aCount <= INT32_MAX);
+ int32_t bytesRead = PR_Read(mFD, aBuf, std::min<uint32_t>(aCount, INT32_MAX));
if (bytesRead == -1) {
return NS_ErrorAccordingToNSPR();
}
@@ -265,7 +268,8 @@ nsresult nsFileStreamBase::Write(const char* buf, uint32_t count,
nsresult rv = DoPendingOpen();
NS_ENSURE_SUCCESS(rv, rv);
- int32_t cnt = PR_Write(mFD, buf, count);
+ MOZ_ASSERT(count <= INT32_MAX);
+ int32_t cnt = PR_Write(mFD, buf, std::min<uint32_t>(count, INT32_MAX));
if (cnt == -1) {
return NS_ErrorAccordingToNSPR();
}
Loading diff…
References
On This Page