Firefox · Widget
CVE-2025-4092
Memory Corruption in Widget
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifwidget/gtk/nsWindow.cpp |
modified |
Files Changed
widget/gtk/nsDragService.cppwidget/gtk/nsWindow.cpp
Patch
diff --git a/widget/gtk/nsDragService.cpp b/widget/gtk/nsDragService.cpp
index f95a9754c33..d0ded4d7349 100644
--- a/widget/gtk/nsDragService.cpp
+++ b/widget/gtk/nsDragService.cpp
@@ -2462,12 +2462,14 @@ void nsDragSession::SetDragIcon(GdkDragContext* aContext) {
// When mDragPopup has a parent it's already attached to D&D context.
// That may happens when D&D operation is aborted but not finished
// on Gtk side yet so let's remove it now.
+ g_object_ref(gtkWidget);
if (GtkWidget* parent = gtk_widget_get_parent(gtkWidget)) {
gtk_container_remove(GTK_CONTAINER(parent), gtkWidget);
}
LOGDRAGSERVICE(" set drag popup [%p]", widget.get());
OpenDragPopup();
gtk_drag_set_icon_widget(aContext, gtkWidget, offsetX, offsetY);
+ g_object_unref(gtkWidget);
return;
} else {
LOGDRAGSERVICE(" NS_NATIVE_SHELLWIDGET is missing!");
diff --git a/widget/gtk/nsWindow.cpp b/widget/gtk/nsWindow.cpp
index d5248f105fe..27c81407827 100644
--- a/widget/gtk/nsWindow.cpp
+++ b/widget/gtk/nsWindow.cpp
@@ -8390,7 +8390,10 @@ static gboolean generic_event_cb(GtkWidget* widget, GdkEvent* aEvent) {
}
void nsWindow::GtkWidgetDestroyHandler(GtkWidget* aWidget) {
- MOZ_RELEASE_ASSERT(mIsDestroyed, "Releasing live widget!");
+ if (!mIsDestroyed) {
+ NS_WARNING("GtkWidgetDestroyHandler called for live nsWindow!");
+ Destroy();
+ }
if (aWidget == mShell) {
mShell = nullptr;
return;
Loading diff…
References
On This Page