Firefox · SpiderMonkey
CVE-2025-14324
Logic Error in SpiderMonkey
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifjs/src/jit/shared/IonAssemblerBufferWithConstantPools.h |
modified |
Files Changed
js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
Patch
diff --git a/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h b/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
index b8f25e517a0..22866a9574c 100644
--- a/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
+++ b/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
@@ -746,8 +746,10 @@ struct AssemblerBufferWithConstantPools
// secondary range veneers assuming the worst case deadlines.
// Total pending secondary range veneer size.
- size_t secondaryVeneers = guardSize_ * (branchDeadlines_.size() -
- branchDeadlines_.maxRangeSize());
+ size_t secondaryVeneers =
+ guardSize_ *
+ (branchDeadlines_.size() - branchDeadlines_.maxRangeSize()) *
+ InstSize;
if (deadline < poolEnd + secondaryVeneers) {
return false;
Loading diff…
References
On This Page