Firefox · DOM
CVE-2026-92027
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/streams/ReadableByteStreamController.cpp
Patch
diff --git a/dom/streams/ReadableByteStreamController.cpp b/dom/streams/ReadableByteStreamController.cpp
index cffa45777fd..b5c9c9b2274 100644
--- a/dom/streams/ReadableByteStreamController.cpp
+++ b/dom/streams/ReadableByteStreamController.cpp
@@ -826,6 +826,10 @@ MOZ_CAN_RUN_SCRIPT void ReadableByteStreamControllerFillReadRequestFromQueue(
// byte offset, entry’s byte length »).
aRv.MightThrowJSException();
JS::Rooted<JSObject*> buffer(aCx, entry->Buffer());
+ if (!JS_WrapObject(aCx, &buffer)) {
+ aRv.StealExceptionFromJSContext(aCx);
+ return;
+ }
JS::Rooted<JSObject*> view(
aCx, JS_NewUint8ArrayWithBuffer(aCx, buffer, entry->ByteOffset(),
int64_t(entry->ByteLength())));
Loading diff…
References
On This Page