High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionWhen manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitable crash.
ComponentDOM
Bug ClassLogic Error
Tracker1920381
Fix commit148ccccc2009 (firefox) +7/-0
CISA KEVNot listed
CreditedAtte Kettunen
Disclosed2024-10-14

Files Changed

  • dom/base/Selection.cpp
diff --git a/dom/base/Selection.cpp b/dom/base/Selection.cpp
index b080f98ebbc..0ad66b0882b 100644
--- a/dom/base/Selection.cpp
+++ b/dom/base/Selection.cpp
@@ -331,6 +331,13 @@ const nsTHashSet<const nsINode*>& SelectionNodeCache::MaybeCollect(
     nsTHashSet<const nsINode*> fullySelectedNodes;
     for (size_t rangeIndex = 0; rangeIndex < sel->RangeCount(); ++rangeIndex) {
       AbstractRange* range = sel->GetAbstractRangeAt(rangeIndex);
+      MOZ_ASSERT(range);
+      if (range->Collapsed()) {
+        continue;
+      }
+      if (range->IsStaticRange() && !range->AsStaticRange()->IsValid()) {
+        continue;
+      }
       const RangeBoundary& startRef = range->MayCrossShadowBoundaryStartRef();
       const RangeBoundary& endRef = range->MayCrossShadowBoundaryEndRef();
 
Loading diff…