Medium firefox UAF 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionAssuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash.
ComponentDOM
Bug ClassUAF
Tracker1915535
Fix commit38691eced5eb (firefox) +10/-6
CISA KEVNot listed
CreditedIrvan Kurniawan
Disclosed2025-01-07

Files Changed

  • dom/base/nsLineBreaker.cpp
diff --git a/dom/base/nsLineBreaker.cpp b/dom/base/nsLineBreaker.cpp
index 7175e9ab1eb..1edcfdd05d2 100644
--- a/dom/base/nsLineBreaker.cpp
+++ b/dom/base/nsLineBreaker.cpp
@@ -15,6 +15,7 @@
 #include "mozilla/intl/LineBreaker.h"  // for LineBreaker::ComputeBreakPositions
 #include "mozilla/intl/Locale.h"
 #include "mozilla/intl/UnicodeProperties.h"
+#include "mozilla/ScopeExit.h"
 #include "mozilla/StaticPrefs_intl.h"
 
 using mozilla::AutoRestore;
@@ -150,6 +151,15 @@ static void SetupCapitalization(const char16_t* aWord, uint32_t aLength,
 }
 
 nsresult nsLineBreaker::FlushCurrentWord() {
+  auto cleanup = MakeScopeExit([&] {
+    mCurrentWord.Clear();
+    mTextItems.Clear();
+    mCurrentWordMightBeBreakable = false;
+    mCurrentWordContainsMixedLang = false;
+    mCurrentWordLanguage = nullptr;
+    mWordContinuation = false;
+  });
+
   uint32_t length = mCurrentWord.Length();
   AutoTArray<uint8_t, 4000> breakState;
   if (!breakState.AppendElements(length, mozilla::fallible)) {
@@ -232,12 +242,6 @@ nsresult nsLineBreaker::FlushCurrentWord() {
     offset += ti->mLength;
   }
 
-  mCurrentWord.Clear();
-  mTextItems.Clear();
-  mCurrentWordMightBeBreakable = false;
-  mCurrentWordContainsMixedLang = false;
-  mCurrentWordLanguage = nullptr;
-  mWordContinuation = false;
   return NS_OK;
 }
 
Loading diff…