Firefox · Widget
CVE-2024-11699
Memory Corruption in Widget
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifwidget/cocoa/nsCocoaWindow.mm |
modified |
Files Changed
widget/cocoa/nsCocoaWindow.hwidget/cocoa/nsCocoaWindow.mm
Patch
diff --git a/widget/cocoa/nsCocoaWindow.h b/widget/cocoa/nsCocoaWindow.h
index 56112af3c1b..3ec880392d2 100644
--- a/widget/cocoa/nsCocoaWindow.h
+++ b/widget/cocoa/nsCocoaWindow.h
@@ -42,6 +42,7 @@ enum class NativeKeyBindingsType : uint8_t;
BOOL mDisabledNeedsDisplay;
NSTrackingArea* mTrackingArea;
+ NSView* mViewWithTrackingArea;
NSRect mDirtyRect;
diff --git a/widget/cocoa/nsCocoaWindow.mm b/widget/cocoa/nsCocoaWindow.mm
index 4a8d455c6c3..18fa75869a3 100644
--- a/widget/cocoa/nsCocoaWindow.mm
+++ b/widget/cocoa/nsCocoaWindow.mm
@@ -3175,6 +3175,7 @@ static NSMutableSet* gSwizzledFrameViewClasses = nil;
mState = nil;
mDisabledNeedsDisplay = NO;
mTrackingArea = nil;
+ mViewWithTrackingArea = nil;
mDirtyRect = NSZeroRect;
mBeingShown = NO;
mDrawTitle = NO;
@@ -3387,25 +3388,28 @@ static const NSString* kStateWantsTitleDrawn = @"wantsTitleDrawn";
}
- (void)removeTrackingArea {
- if (mTrackingArea) {
- [self.trackingAreaView removeTrackingArea:mTrackingArea];
- [mTrackingArea release];
- mTrackingArea = nil;
- }
+ [mViewWithTrackingArea removeTrackingArea:mTrackingArea];
+
+ [mTrackingArea release];
+ mTrackingArea = nil;
+
+ [mViewWithTrackingArea release];
+ mViewWithTrackingArea = nil;
}
- (void)updateTrackingArea {
[self removeTrackingArea];
- NSView* view = self.trackingAreaView;
+ mViewWithTrackingArea = [self.trackingAreaView retain];
const NSTrackingAreaOptions options = NSTrackingMouseEnteredAndExited |
NSTrackingMouseMoved |
NSTrackingActiveAlways;
- mTrackingArea = [[NSTrackingArea alloc] initWithRect:[view bounds]
- options:options
- owner:self
- userInfo:nil];
- [view addTrackingArea:mTrackingArea];
+ mTrackingArea =
+ [[NSTrackingArea alloc] initWithRect:[mViewWithTrackingArea bounds]
+ options:options
+ owner:self
+ userInfo:nil];
+ [mViewWithTrackingArea addTrackingArea:mTrackingArea];
}
- (void)mouseEntered:(NSEvent*)aEvent {
Loading diff…
References
On This Page