PatchGap
Firefox · SpiderMonkey

CVE-2025-4919

OOB in SpiderMonkey
Critical firefox OOB 🔧 Commit mapped

Overview

Critical
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactcritical
DescriptionAn attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes.
ComponentSpiderMonkey
Bug ClassOOB
Tracker1966614
Fix commitb03604255211 (firefox) +4/-0
CISA KEVNot listed
CreditedManfred Paul working with Trend Micro's Zero Day Initiative
Disclosed2025-05-17

Changed Functions

FunctionChangeNotes
if
js/src/jit/IonAnalysis.cpp
 modified

Files Changed

  • js/src/jit/IonAnalysis.cpp

Patch

view commit
diff --git a/js/src/jit/IonAnalysis.cpp b/js/src/jit/IonAnalysis.cpp
index 2d4ede1461a..d5733f5123d 100644
--- a/js/src/jit/IonAnalysis.cpp
+++ b/js/src/jit/IonAnalysis.cpp
@@ -3726,6 +3726,10 @@ SimpleLinearSum jit::ExtractLinearSum(MDefinition* ins, MathSpace space,
   }
   MOZ_ASSERT(space == MathSpace::Modulo || space == MathSpace::Infinite);
 
+  if (space == MathSpace::Modulo) {
+    return SimpleLinearSum(ins, 0);
+  }
+
   MDefinition* lhs = ins->getOperand(0);
   MDefinition* rhs = ins->getOperand(1);
   if (lhs->type() != MIRType::Int32 || rhs->type() != MIRType::Int32) {
Loading diff…
On This Page