Firefox · DOM
CVE-2025-1931
UAF in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/webtransport/child/WebTransportChild.cpp |
modified |
Files Changed
dom/webtransport/child/WebTransportChild.cpp
Patch
diff --git a/dom/webtransport/child/WebTransportChild.cpp b/dom/webtransport/child/WebTransportChild.cpp
index 12714b003e9..e7c279398cf 100644
--- a/dom/webtransport/child/WebTransportChild.cpp
+++ b/dom/webtransport/child/WebTransportChild.cpp
@@ -34,7 +34,8 @@ void WebTransportChild::CloseAll() {
::mozilla::ipc::IPCResult WebTransportChild::RecvRemoteClosed(
const bool& aCleanly, const uint32_t& aCode, const nsACString& aReason) {
if (mTransport) {
- mTransport->RemoteClosed(aCleanly, aCode, aReason);
+ RefPtr<WebTransport> self(mTransport);
+ self->RemoteClosed(aCleanly, aCode, aReason);
}
return IPC_OK();
}
@@ -43,7 +44,8 @@ void WebTransportChild::CloseAll() {
const uint64_t& aStreamId, const RefPtr<DataPipeReceiver>& aIncoming,
const RefPtr<DataPipeSender>& aOutgoing) {
if (mTransport) {
- mTransport->NewBidirectionalStream(aStreamId, aIncoming, aOutgoing);
+ RefPtr<WebTransport> self(mTransport);
+ self->NewBidirectionalStream(aStreamId, aIncoming, aOutgoing);
}
return IPC_OK();
}
@@ -51,7 +53,8 @@ void WebTransportChild::CloseAll() {
::mozilla::ipc::IPCResult WebTransportChild::RecvIncomingUnidirectionalStream(
const uint64_t& aStreamId, const RefPtr<DataPipeReceiver>& aStream) {
if (mTransport) {
- mTransport->NewUnidirectionalStream(aStreamId, aStream);
+ RefPtr<WebTransport> self(mTransport);
+ self->NewUnidirectionalStream(aStreamId, aStream);
}
return IPC_OK();
}
@@ -59,7 +62,8 @@ void WebTransportChild::CloseAll() {
::mozilla::ipc::IPCResult WebTransportChild::RecvIncomingDatagram(
nsTArray<uint8_t>&& aData, const TimeStamp& aRecvTimeStamp) {
if (mTransport) {
- mTransport->NewDatagramReceived(std::move(aData), aRecvTimeStamp);
+ RefPtr<WebTransport> self(mTransport);
+ self->NewDatagramReceived(std::move(aData), aRecvTimeStamp);
}
return IPC_OK();
}
@@ -67,7 +71,8 @@ void WebTransportChild::CloseAll() {
::mozilla::ipc::IPCResult WebTransportChild::RecvOnStreamResetOrStopSending(
const uint64_t& aStreamId, const StreamResetOrStopSendingError& aError) {
if (mTransport) {
- mTransport->OnStreamResetOrStopSending(aStreamId, aError);
+ RefPtr<WebTransport> self(mTransport);
+ self->OnStreamResetOrStopSending(aStreamId, aError);
}
return IPC_OK();
}
Loading diff…
References
On This Page