Firefox · SpiderMonkey
CVE-2025-1936
Logic Error in SpiderMonkey
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/xhr/XMLHttpRequestMainThread.cpp |
modified | |
ifgfx/thebes/gfxFT2FontList.cpp |
modified | |
ifintl/hyphenation/glue/nsHyphenator.cpp |
modified | |
ifintl/locale/LocaleService.cpp |
modified | |
ifjs/xpconnect/loader/URLPreloader.cpp |
modified | |
ifmodules/libjar/nsJAR.cpp |
modified |
Files Changed
dom/xhr/XMLHttpRequestMainThread.cppgfx/thebes/gfxFT2FontList.cppintl/hyphenation/glue/nsHyphenator.cppintl/locale/LocaleService.cppjs/xpconnect/loader/URLPreloader.cppmodules/libjar/nsJAR.cppmodules/libjar/nsJARInputStream.cppmodules/libjar/nsZipArchive.cppmodules/libjar/nsZipArchive.htoolkit/mozapps/extensions/AddonManagerStartup.cppxpcom/build/FileLocation.cppxpcom/build/FileLocation.hxpcom/build/Omnijar.cppxpcom/components/nsComponentManager.cpp
Patch
diff --git a/dom/xhr/XMLHttpRequestMainThread.cpp b/dom/xhr/XMLHttpRequestMainThread.cpp
index 59352f1e716..e9472466d26 100644
--- a/dom/xhr/XMLHttpRequestMainThread.cpp
+++ b/dom/xhr/XMLHttpRequestMainThread.cpp
@@ -4182,7 +4182,7 @@ nsresult ArrayBufferBuilder::MapToFileInPackage(const nsCString& aFile,
if (!zip) {
return NS_ERROR_FAILURE;
}
- nsZipItem* zipItem = zip->GetItem(aFile.get());
+ nsZipItem* zipItem = zip->GetItem(aFile);
if (!zipItem) {
return NS_ERROR_FILE_NOT_FOUND;
}
diff --git a/gfx/thebes/gfxFT2FontList.cpp b/gfx/thebes/gfxFT2FontList.cpp
index 5c94e81d9be..13a32ef76fd 100644
--- a/gfx/thebes/gfxFT2FontList.cpp
+++ b/gfx/thebes/gfxFT2FontList.cpp
@@ -103,7 +103,7 @@ already_AddRefed<SharedFTFace> FT2FontEntry::GetFTFace(bool aCommit) {
RefPtr<SharedFTFace> face;
if (mFilename[0] != '/') {
RefPtr<nsZipArchive> reader = Omnijar::GetReader(Omnijar::Type::GRE);
- nsZipItem* item = reader->GetItem(mFilename.get());
+ nsZipItem* item = reader->GetItem(mFilename);
NS_ASSERTION(item, "failed to find zip entry");
uint32_t bufSize = item->RealSize();
@@ -468,7 +468,7 @@ hb_face_t* FT2FontEntry::CreateHBFace() const {
// A relative path means an omnijar resource, which we may need to
// decompress to a temporary buffer.
RefPtr<nsZipArchive> reader = Omnijar::GetReader(Omnijar::Type::GRE);
- nsZipItem* item = reader->GetItem(mFilename.get());
+ nsZipItem* item = reader->GetItem(mFilename);
MOZ_ASSERT(item, "failed to find zip entry");
if (item) {
// TODO(jfkthame):
@@ -1510,7 +1510,7 @@ void gfxFT2FontList::AppendFacesFromOmnijarEntry(nsZipArchive* aArchive,
}
}
- nsZipItem* item = aArchive->GetItem(aEntryName.get());
+ nsZipItem* item = aArchive->GetItem(aEntryName);
NS_ASSERTION(item, "failed to find zip entry");
uint32_t bufSize = item->RealSize();
diff --git a/intl/hyphenation/glue/nsHyphenator.cpp b/intl/hyphenation/glue/nsHyphenator.cpp
index e506a3a423d..40ce45018b9 100644
--- a/intl/hyphenation/glue/nsHyphenator.cpp
+++ b/intl/hyphenation/glue/nsHyphenator.cpp
@@ -52,7 +52,7 @@ static const void* GetItemPtrFromJarURI(nsIJARURI* aJAR, uint32_t* aLength) {
if (archive) {
nsCString path;
aJAR->GetJAREntry(path);
- nsZipItem* item = archive->GetItem(path.get());
+ nsZipItem* item = archive->GetItem(path);
if (item && item->Compression() == 0 && item->Size() > 0) {
// We do NOT own this data, but it won't go away until the omnijar
// file is closed during shutdown.
diff --git a/intl/locale/LocaleService.cpp b/intl/locale/LocaleService.cpp
index 1527f279103..7cb42fbb11c 100644
--- a/intl/locale/LocaleService.cpp
+++ b/intl/locale/LocaleService.cpp
@@ -338,7 +338,7 @@ static bool GetGREFileContents(const char* aFilePath, nsCString* aOutString) {
// Look for the requested file in omnijar.
RefPtr<nsZipArchive> zip = Omnijar::GetReader(Omnijar::GRE);
if (zip) {
- nsZipItemPtr<char> item(zip, aFilePath);
+ nsZipItemPtr<char> item(zip, nsDependentCString(aFilePath));
if (!item) {
return false;
}
diff --git a/js/xpconnect/loader/URLPreloader.cpp b/js/xpconnect/loader/URLPreloader.cpp
index 1aa18aca44f..6721cd04711 100644
--- a/js/xpconnect/loader/URLPreloader.cpp
+++ b/js/xpconnect/loader/URLPreloader.cpp
@@ -402,7 +402,7 @@ void URLPreloader::BackgroundReadFiles() {
entry->TypeString(), entry->mPath.get());
}
- auto item = zip->GetItem(entry->mPath.get());
+ auto item = zip->GetItem(entry->mPath);
if (!item) {
entry->mResultCode = NS_ERROR_FILE_NOT_FOUND;
continue;
@@ -567,7 +567,7 @@ Result<nsCString, nsresult> URLPreloader::ReadURIInternal(nsIURI* uri,
}
// Not an Omnijar archive, so just read it directly.
- FileLocation location(zip, PromiseFlatCString(path).BeginReading());
+ FileLocation location(zip, path);
return URLEntry::ReadLocation(location);
}
@@ -636,7 +636,7 @@ Result<FileLocation, nsresult> URLPreloader::CacheKey::ToFileLocation() {
}
RefPtr<nsZipArchive> zip = Archive();
- return FileLocation(zip, mPath.get());
+ return FileLocation(zip, mPath);
}
Result<nsCString, nsresult> URLPreloader::URLEntry::Read() {
diff --git a/modules/libjar/nsJAR.cpp b/modules/libjar/nsJAR.cpp
index bc413190705..8193e72563f 100644
--- a/modules/libjar/nsJAR.cpp
+++ b/modules/libjar/nsJAR.cpp
@@ -135,8 +135,7 @@ nsJAR::OpenInner(nsIZipReader* aZipReader, const nsACString& aZipEntry) {
{
nsJAR* outerJAR = static_cast<nsJAR*>(aZipReader);
RecursiveMutexAutoLock outerLock(outerJAR->mLock);
- rv = nsZipHandle::Init(outerJAR->mZip.get(),
- PromiseFlatCString(aZipEntry).get(),
+ rv = nsZipHandle::Init(outerJAR->mZip.get(), aZipEntry,
getter_AddRefs(handle));
NS_ENSURE_SUCCESS(rv, rv);
}
@@ -191,8 +190,7 @@ nsJAR::Test(const nsACString& aEntryName) {
if (!mZip) {
return NS_ERROR_FAILURE;
}
- return mZip->Test(
- aEntryName.IsEmpty() ? nullptr : PromiseFlatCString(aEntryName).get());
+ return mZip->Test(aEntryName);
}
NS_IMETHODIMP
@@ -205,7 +203,7 @@ nsJAR::Extract(const nsACString& aEntryName, nsIFile* outFile) {
}
LOG(("Extract[%p] %s", this, PromiseFlatCString(aEntryName).get()));
- nsZipItem* item = mZip->GetItem(PromiseFlatCString(aEntryName).get());
+ nsZipItem* item = mZip->GetItem(aEntryName);
NS_ENSURE_TRUE(item, NS_ERROR_FILE_NOT_FOUND);
// Remove existing file or directory so we set permissions correctly.
@@ -245,7 +243,7 @@ nsJAR::GetEntry(const nsACString& aEntryName, nsIZipEntry** result) {
if (!mZip) {
return NS_ERROR_FAILURE;
}
- nsZipItem* zipItem = mZip->GetItem(PromiseFlatCString(aEntryName).get());
+ nsZipItem* zipItem = mZip->GetItem(aEntryName);
NS_ENSURE_TRUE(zipItem, NS_ERROR_FILE_NOT_FOUND);
RefPtr<nsJARItem> jarItem = new nsJARItem(zipItem);
@@ -261,7 +259,7 @@ nsJAR::HasEntry(const nsACString& aEntryName, bool* result) {
if (!mZip) {
return NS_ERROR_FAILURE;
}
- *result = mZip->GetItem(PromiseFlatCString(aEntryName).get()) != nullptr;
+ *result = mZip->GetItem(aEntryName) != nullptr;
return NS_OK;
}
@@ -301,7 +299,7 @@ nsJAR::GetInputStream(const nsACString& aEntryName, nsIInputStream** result) {
const nsCString& entry = PromiseFlatCString(aEntryName);
if (*entry.get()) {
// First check if item exists in jar
- item = mZip->GetItem(entry.get());
+ item = mZip->GetItem(entry);
if (!item) return NS_ERROR_FILE_NOT_FOUND;
}
RefPtr<nsJARInputStream> jis = new nsJARInputStream();
diff --git a/modules/libjar/nsJARInputStream.cpp b/modules/libjar/nsJARInputStream.cpp
index 83f8f3c224e..8095f9edf12 100644
--- a/modules/libjar/nsJARInputStream.cpp
+++ b/modules/libjar/nsJARInputStream.cpp
@@ -341,7 +341,8 @@ nsresult nsJARInputStream::ReadDirectory(char* aBuffer, uint32_t aCount,
const char* entryName = mArray[mArrPos].get();
uint32_t entryNameLen = mArray[mArrPos].Length();
- nsZipItem* ze = mJar->mZip->GetItem(entryName);
+ nsZipItem* ze = mJar->mZip->GetItem(
+ nsDependentCString(mArray[mArrPos].get(), mArray[mArrPos].Length()));
NS_ENSURE_TRUE(ze, NS_ERROR_FILE_NOT_FOUND);
// Last Modified Time
diff --git a/modules/libjar/nsZipArchive.cpp b/modules/libjar/nsZipArchive.cpp
index cf894dc9d1e..dcbd9327b92 100644
--- a/modules/libjar/nsZipArchive.cpp
+++ b/modules/libjar/nsZipArchive.cpp
@@ -237,12 +237,12 @@ nsresult nsZipHandle::Init(nsIFile* file, nsZipHandle** ret, PRFileDesc** aFd) {
return NS_OK;
}
-nsresult nsZipHandle::Init(nsZipArchive* zip, const char* entry,
+nsresult nsZipHandle::Init(nsZipArchive* zip, const nsACString& entry,
nsZipHandle** ret) {
RefPtr<nsZipHandle> handle = new nsZipHandle();
if (!handle) return NS_ERROR_OUT_OF_MEMORY;
- LOG(("ZipHandle::Init entry %s", entry));
+ LOG(("ZipHandle::Init entry %s", PromiseFlatCString(entry).get()));
nsZipItem* item = zip->GetItem(entry);
if (item && item->Compression() == DEFLATED &&
@@ -414,10 +414,10 @@ already_AddRefed<nsZipArchive> nsZipArchive::OpenArchive(nsIFile* aFile) {
//---------------------------------------------
// nsZipArchive::Test
//---------------------------------------------
-nsresult nsZipArchive::Test(const char* aEntryName) {
+nsresult nsZipArchive::Test(const nsACString& aEntryName) {
Loading diff…
References
On This Page