Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionSandbox escape due to incorrect boundary conditions in the Widget: Win32 component
ComponentWidget
Bug ClassLogic Error
Tracker2058018
Fix commitf5b0004d31ed (firefox) +2/-2
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-15

Files Changed

  • widget/windows/nsNativeDragTarget.cpp
diff --git a/widget/windows/nsNativeDragTarget.cpp b/widget/windows/nsNativeDragTarget.cpp
index 437c37bbc5b..db7da3185c4 100644
--- a/widget/windows/nsNativeDragTarget.cpp
+++ b/widget/windows/nsNativeDragTarget.cpp
@@ -283,13 +283,13 @@ nsNativeDragTarget::DragEnter(LPDATAOBJECT pIDataSource, DWORD grfKeyState,
   nsresult loadResult = nsClipboard::GetNativeDataOffClipboard(
       pIDataSource, 0, ::RegisterClipboardFormat(CFSTR_PREFERREDDROPEFFECT),
       nullptr, &tempOutData, &tempDataLen);
-  if (NS_SUCCEEDED(loadResult) && tempOutData) {
+  if (NS_SUCCEEDED(loadResult) && tempOutData && tempDataLen >= sizeof(DWORD)) {
     mEffectsPreferred = *((DWORD*)tempOutData);
-    free(tempOutData);
   } else {
     // We have no preference if we can't obtain it
     mEffectsPreferred = DROPEFFECT_NONE;
   }
+  free(tempOutData);
   LOGD(
       "[%p] %s | grfKeyState: %lu | ptl: (%ld, %ld) | mEffectsAllowed: %lu"
       " | mEffectsPreferred: %lu",
Loading diff…