High firefox Memory Corruption 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionMemory safety bugs present in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentCore
Bug ClassMemory Corruption
Tracker1929482
Fix commit9070ee73eca3 (firefox) +13/-10
CISA KEVNot listed
CreditedPaul Bone, Ryan VanderMeulen and the Mozilla Fuzzing Team
Disclosed2025-08-19

Files Changed

  • tools/profiler/core/MicroGeckoProfiler.cpp
diff --git a/tools/profiler/core/MicroGeckoProfiler.cpp b/tools/profiler/core/MicroGeckoProfiler.cpp
index 9a0062171bc..2a5dd09254d 100644
--- a/tools/profiler/core/MicroGeckoProfiler.cpp
+++ b/tools/profiler/core/MicroGeckoProfiler.cpp
@@ -201,9 +201,10 @@ void uprofiler_simple_event_marker_internal(
   }
   MOZ_ASSERT(num_args <= TraceMarker::MAX_NUM_ARGS);
   TraceMarker::OptionsType tuple;
-  TraceOption* args[6] = {&std::get<0>(tuple), &std::get<1>(tuple),
-                          &std::get<2>(tuple), &std::get<3>(tuple),
-                          &std::get<4>(tuple), &std::get<5>(tuple)};
+  TraceOption* args[TraceMarker::MAX_NUM_ARGS] = {
+      &std::get<0>(tuple), &std::get<1>(tuple), &std::get<2>(tuple),
+      &std::get<3>(tuple), &std::get<4>(tuple), &std::get<5>(tuple)};
+  nsCString strValueContainers[TraceMarker::MAX_NUM_ARGS];
   for (int i = 0; i < std::min(num_args, TraceMarker::MAX_NUM_ARGS); ++i) {
     auto& arg = *args[i];
     arg.mPassed = true;
@@ -228,9 +229,10 @@ void uprofiler_simple_event_marker_internal(
                           ->as_double);
         break;
       case TRACE_VALUE_TYPE_POINTER:
-        arg.mValue = AsVariant(ProfilerString8View(nsPrintfCString(
+        strValueContainers[i] = nsPrintfCString(
             "%p", reinterpret_cast<const TraceValueUnion*>(&arg_values[i])
-                      ->as_pointer)));
+                      ->as_pointer);
+        arg.mValue = AsVariant(ProfilerString8View(strValueContainers[i]));
         break;
       case TRACE_VALUE_TYPE_STRING:
         arg.mValue = AsVariant(ProfilerString8View::WrapNullTerminatedString(
@@ -238,14 +240,15 @@ void uprofiler_simple_event_marker_internal(
                 ->as_string));
         break;
       case TRACE_VALUE_TYPE_COPY_STRING:
-        arg.mValue = AsVariant(ProfilerString8View(
-            nsCString(reinterpret_cast<const TraceValueUnion*>(&arg_values[i])
-                          ->as_string)));
+        strValueContainers[i] =
+            reinterpret_cast<const TraceValueUnion*>(&arg_values[i])->as_string;
+        arg.mValue = AsVariant(ProfilerString8View(strValueContainers[i]));
         break;
       default:
         MOZ_ASSERT_UNREACHABLE("Unexpected trace value type");
-        arg.mValue = AsVariant(ProfilerString8View(
-            nsPrintfCString("Unexpected type: %u", arg_types[i])));
+        strValueContainers[i] =
+            nsPrintfCString("Unexpected type: %u", arg_types[i]);
+        arg.mValue = AsVariant(ProfilerString8View(strValueContainers[i]));
         break;
     }
   }
Loading diff…