Firefox · DOM
CVE-2026-100772
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/xml/nsXMLContentSink.cppdom/xml/nsXMLContentSink.hdom/xml/nsXMLFragmentContentSink.cpp
Patch
diff --git a/dom/xml/nsXMLContentSink.cpp b/dom/xml/nsXMLContentSink.cpp
index 77ec01bd946..a07667efd11 100644
--- a/dom/xml/nsXMLContentSink.cpp
+++ b/dom/xml/nsXMLContentSink.cpp
@@ -1021,12 +1021,12 @@ nsXMLContentSink::HandleStartElement(const char16_t* aName,
uint32_t aAttsCount, uint32_t aLineNumber,
uint32_t aColumnNumber) {
return HandleStartElement(aName, aAtts, aAttsCount, aLineNumber,
- aColumnNumber, true);
+ aColumnNumber, FROM_PARSER_NETWORK);
}
nsresult nsXMLContentSink::HandleStartElement(
const char16_t* aName, const char16_t** aAtts, uint32_t aAttsCount,
- uint32_t aLineNumber, uint32_t aColumnNumber, bool aInterruptable) {
+ uint32_t aLineNumber, uint32_t aColumnNumber, FromParser aFromParser) {
MOZ_RELEASE_ASSERT(aAttsCount % 2 == 0, "incorrect aAttsCount");
// Adjust aAttsCount so it's the actual number of attributes
aAttsCount /= 2;
@@ -1059,9 +1059,9 @@ nsresult nsXMLContentSink::HandleStartElement(
nodeInfo = mNodeInfoManager->GetNodeInfo(localName, prefix, nameSpaceID,
nsINode::ELEMENT_NODE);
- result = CreateElement(aAtts, aAttsCount, nodeInfo, aLineNumber,
- aColumnNumber, getter_AddRefs(content), &appendContent,
- FROM_PARSER_NETWORK);
+ result =
+ CreateElement(aAtts, aAttsCount, nodeInfo, aLineNumber, aColumnNumber,
+ getter_AddRefs(content), &appendContent, aFromParser);
NS_ENSURE_SUCCESS(result, result);
// Have to do this before we push the new content on the stack... and have to
@@ -1112,8 +1112,7 @@ nsresult nsXMLContentSink::HandleStartElement(
nsContentUtils::AddScriptRunner(
MakeAndAddRef<nsDocElementCreatedNotificationRunner>(mDocument));
- if (aInterruptable && NS_SUCCEEDED(result) && mParser &&
- !mParser->IsParserEnabled()) {
+ if (NS_SUCCEEDED(result) && mParser && !mParser->IsParserEnabled()) {
return NS_ERROR_HTMLPARSER_BLOCK;
}
} else if (!mCurrentHead) {
@@ -1123,8 +1122,7 @@ nsresult nsXMLContentSink::HandleStartElement(
}
}
- return aInterruptable && NS_SUCCEEDED(result) ? DidProcessATokenImpl()
- : result;
+ return NS_SUCCEEDED(result) ? DidProcessATokenImpl() : result;
}
NS_IMETHODIMP
diff --git a/dom/xml/nsXMLContentSink.h b/dom/xml/nsXMLContentSink.h
index 20e4a706e34..e9d2c0b3520 100644
--- a/dom/xml/nsXMLContentSink.h
+++ b/dom/xml/nsXMLContentSink.h
@@ -178,7 +178,8 @@ class nsXMLContentSink : public nsContentSink,
nsresult HandleStartElement(const char16_t* aName, const char16_t** aAtts,
uint32_t aAttsCount, uint32_t aLineNumber,
- uint32_t aColumnNumber, bool aInterruptable);
+ uint32_t aColumnNumber,
+ mozilla::dom::FromParser aFromParser);
nsresult HandleEndElement(const char16_t* aName, bool aInterruptable);
nsresult HandleCharacterData(const char16_t* aData, uint32_t aLength,
bool aInterruptable);
diff --git a/dom/xml/nsXMLFragmentContentSink.cpp b/dom/xml/nsXMLFragmentContentSink.cpp
index dea4e4e2d92..fc00573c2f0 100644
--- a/dom/xml/nsXMLFragmentContentSink.cpp
+++ b/dom/xml/nsXMLFragmentContentSink.cpp
@@ -39,6 +39,9 @@ class nsXMLFragmentContentSink : public nsXMLContentSink,
const nsAString& aSystemId,
const nsAString& aPublicId,
nsISupports* aCatalogData) override;
+ NS_IMETHOD HandleStartElement(const char16_t* aName, const char16_t** aAtts,
+ uint32_t aAttsCount, uint32_t aLineNumber,
+ uint32_t aColumnNumber) override;
NS_IMETHOD HandleProcessingInstruction(const char16_t* aTarget,
const char16_t* aData) override;
NS_IMETHOD HandleXMLDeclaration(const char16_t* aVersion,
@@ -159,6 +162,17 @@ bool nsXMLFragmentContentSink::SetDocElement(int32_t aNameSpaceID,
return false;
}
+NS_IMETHODIMP
+nsXMLFragmentContentSink::HandleStartElement(const char16_t* aName,
+ const char16_t** aAtts,
+ uint32_t aAttsCount,
+ uint32_t aLineNumber,
+ uint32_t aColumnNumber) {
+ return nsXMLContentSink::HandleStartElement(aName, aAtts, aAttsCount,
+ aLineNumber, aColumnNumber,
+ FROM_PARSER_FRAGMENT);
+}
+
nsresult nsXMLFragmentContentSink::CreateElement(
const char16_t** aAtts, uint32_t aAttsCount,
mozilla::dom::NodeInfo* aNodeInfo, uint32_t aLineNumber,
Loading diff…
References
On This Page