High firefox Memory Corruption 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionMemory safety bugs present in Firefox 137 and Thunderbird 137. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentWidget
Bug ClassMemory Corruption
Tracker1924108
Fix commit4aa23c960850 (firefox) +6/-1
CISA KEVNot listed
CreditedRandell Jesup, Jens Stutte, and the Mozilla Fuzzing Team
Disclosed2025-04-29

Changed Functions

FunctionChangeNotes
if
widget/gtk/nsWindow.cpp
modified

Files Changed

  • widget/gtk/nsDragService.cpp
  • widget/gtk/nsWindow.cpp
diff --git a/widget/gtk/nsDragService.cpp b/widget/gtk/nsDragService.cpp
index f95a9754c33..d0ded4d7349 100644
--- a/widget/gtk/nsDragService.cpp
+++ b/widget/gtk/nsDragService.cpp
@@ -2462,12 +2462,14 @@ void nsDragSession::SetDragIcon(GdkDragContext* aContext) {
           // When mDragPopup has a parent it's already attached to D&D context.
           // That may happens when D&D operation is aborted but not finished
           // on Gtk side yet so let's remove it now.
+          g_object_ref(gtkWidget);
           if (GtkWidget* parent = gtk_widget_get_parent(gtkWidget)) {
             gtk_container_remove(GTK_CONTAINER(parent), gtkWidget);
           }
           LOGDRAGSERVICE("  set drag popup [%p]", widget.get());
           OpenDragPopup();
           gtk_drag_set_icon_widget(aContext, gtkWidget, offsetX, offsetY);
+          g_object_unref(gtkWidget);
           return;
         } else {
           LOGDRAGSERVICE("  NS_NATIVE_SHELLWIDGET is missing!");
diff --git a/widget/gtk/nsWindow.cpp b/widget/gtk/nsWindow.cpp
index d5248f105fe..27c81407827 100644
--- a/widget/gtk/nsWindow.cpp
+++ b/widget/gtk/nsWindow.cpp
@@ -8390,7 +8390,10 @@ static gboolean generic_event_cb(GtkWidget* widget, GdkEvent* aEvent) {
 }
 
 void nsWindow::GtkWidgetDestroyHandler(GtkWidget* aWidget) {
-  MOZ_RELEASE_ASSERT(mIsDestroyed, "Releasing live widget!");
+  if (!mIsDestroyed) {
+    NS_WARNING("GtkWidgetDestroyHandler called for live nsWindow!");
+    Destroy();
+  }
   if (aWidget == mShell) {
     mShell = nullptr;
     return;
Loading diff…