Firefox · Widget
CVE-2026-92065
Logic Error in Widget
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
widget/windows/nsNativeDragTarget.cpp
Patch
diff --git a/widget/windows/nsNativeDragTarget.cpp b/widget/windows/nsNativeDragTarget.cpp
index 437c37bbc5b..db7da3185c4 100644
--- a/widget/windows/nsNativeDragTarget.cpp
+++ b/widget/windows/nsNativeDragTarget.cpp
@@ -283,13 +283,13 @@ nsNativeDragTarget::DragEnter(LPDATAOBJECT pIDataSource, DWORD grfKeyState,
nsresult loadResult = nsClipboard::GetNativeDataOffClipboard(
pIDataSource, 0, ::RegisterClipboardFormat(CFSTR_PREFERREDDROPEFFECT),
nullptr, &tempOutData, &tempDataLen);
- if (NS_SUCCEEDED(loadResult) && tempOutData) {
+ if (NS_SUCCEEDED(loadResult) && tempOutData && tempDataLen >= sizeof(DWORD)) {
mEffectsPreferred = *((DWORD*)tempOutData);
- free(tempOutData);
} else {
// We have no preference if we can't obtain it
mEffectsPreferred = DROPEFFECT_NONE;
}
+ free(tempOutData);
LOGD(
"[%p] %s | grfKeyState: %lu | ptl: (%ld, %ld) | mEffectsAllowed: %lu"
" | mEffectsPreferred: %lu",
Loading diff…
References
On This Page