Firefox · Networking
CVE-2026-8975
Memory Corruption in Networking
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifnetwerk/protocol/http/HttpChannelParent.cpp |
modified |
Files Changed
netwerk/protocol/http/HttpBaseChannel.hnetwerk/protocol/http/HttpChannelChild.cppnetwerk/protocol/http/HttpChannelParent.cpp
Patch
diff --git a/netwerk/protocol/http/HttpBaseChannel.h b/netwerk/protocol/http/HttpBaseChannel.h
index 92c48688729..bc4dfd5d390 100644
--- a/netwerk/protocol/http/HttpBaseChannel.h
+++ b/netwerk/protocol/http/HttpBaseChannel.h
@@ -467,6 +467,7 @@ class HttpBaseChannel : public nsHashPropertyBag,
nsHttpResponseHead* GetResponseHead() const { return mResponseHead.get(); }
nsHttpRequestHead* GetRequestHead() { return &mRequestHead; }
nsHttpHeaderArray* GetResponseTrailers() const {
+ MOZ_DIAGNOSTIC_ASSERT(NS_IsMainThread());
return mResponseTrailers.get();
}
diff --git a/netwerk/protocol/http/HttpChannelChild.cpp b/netwerk/protocol/http/HttpChannelChild.cpp
index 265e04aae60..dc653676c7d 100644
--- a/netwerk/protocol/http/HttpChannelChild.cpp
+++ b/netwerk/protocol/http/HttpChannelChild.cpp
@@ -358,7 +358,7 @@ void HttpChannelChild::ProcessOnStartRequest(
mAltDataInputStream = DeserializeIPCStream(aAltData.altDataInputStream());
mEventQ->RunOrEnqueue(new NeckoTargetChannelFunctionEvent(
- this, [self = UnsafePtr<HttpChannelChild>(this), aResponseHead,
+ this, [self = RefPtr<HttpChannelChild>(this), aResponseHead,
aUseResponseHead, aRequestHeaders, aArgs]() {
self->OnStartRequest(aResponseHead, aUseResponseHead, aRequestHeaders,
aArgs);
@@ -889,15 +889,15 @@ void HttpChannelChild::ProcessOnStopRequest(
if (StaticPrefs::network_send_OnDataFinished()) {
mEventQ->RunOrEnqueue(new ChannelFunctionEvent(
- [self = UnsafePtr<HttpChannelChild>(this)]() {
+ [self = RefPtr<HttpChannelChild>(this)]() {
return self->GetODATarget();
},
- [self = UnsafePtr<HttpChannelChild>(this), status = aChannelStatus]() {
+ [self = RefPtr<HttpChannelChild>(this), status = aChannelStatus]() {
self->SendOnDataFinished(status);
}));
}
mEventQ->RunOrEnqueue(new NeckoTargetChannelFunctionEvent(
- this, [self = UnsafePtr<HttpChannelChild>(this), aChannelStatus, aTiming,
+ this, [self = RefPtr<HttpChannelChild>(this), aChannelStatus, aTiming,
aResponseTrailers,
consoleReports = CopyableTArray{aConsoleReports.Clone()},
aFromSocketProcess]() mutable {
diff --git a/netwerk/protocol/http/HttpChannelParent.cpp b/netwerk/protocol/http/HttpChannelParent.cpp
index 621e7066f4f..5e583310518 100644
--- a/netwerk/protocol/http/HttpChannelParent.cpp
+++ b/netwerk/protocol/http/HttpChannelParent.cpp
@@ -1276,6 +1276,7 @@ HttpChannelParent::OnStartRequest(nsIRequest* aRequest) {
mozilla::ipc::LoadInfoToParentLoadInfoForwarder(loadInfo,
&args.loadInfoForwarder());
+ MOZ_DIAGNOSTIC_ASSERT(NS_IsMainThread());
nsHttpResponseHead* responseHead = chan->GetResponseHead();
bool useResponseHead = !!responseHead;
nsHttpResponseHead cleanedUpResponseHead;
@@ -1357,6 +1358,10 @@ HttpChannelParent::OnStartRequest(nsIRequest* aRequest) {
if (mIPCClosed) {
rv = NS_ERROR_UNEXPECTED;
} else {
+ MOZ_DIAGNOSTIC_ASSERT(
+ responseHead == &cleanedUpResponseHead ||
+ responseHead == chan->GetResponseHead(),
+ "mResponseHead changed between GetResponseHead and copy");
nsHttpResponseHead newResponseHead = *responseHead;
if (!mBgParent->OnStartRequest(
std::move(newResponseHead), useResponseHead,
@@ -1918,6 +1923,7 @@ HttpChannelParent::StartRedirect(nsIChannel* newChannel, uint32_t redirectFlags,
mozilla::ipc::LoadInfoToParentLoadInfoForwarder(loadInfo,
&loadInfoForwarderArg);
+ MOZ_DIAGNOSTIC_ASSERT(NS_IsMainThread());
nsHttpResponseHead* responseHead = mChannel->GetResponseHead();
nsHttpResponseHead cleanedUpResponseHead;
Loading diff…
References
On This Page