Firefox · DOM
CVE-2026-100774
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/html/nsGenericHTMLElement.cpp |
modified |
Files Changed
dom/html/nsGenericHTMLElement.cppdom/html/nsGenericHTMLElement.h
Patch
diff --git a/dom/html/nsGenericHTMLElement.cpp b/dom/html/nsGenericHTMLElement.cpp
index 06950b3e220..ec02dcaed72 100644
--- a/dom/html/nsGenericHTMLElement.cpp
+++ b/dom/html/nsGenericHTMLElement.cpp
@@ -1978,7 +1978,7 @@ void nsGenericHTMLFormElement::BeforeSetAttr(int32_t aNameSpaceID,
bool aNotify) {
if (aNameSpaceID == kNameSpaceID_None && IsFormAssociatedElement()) {
nsAutoString tmp;
- HTMLFormElement* form = GetFormInternal();
+ HTMLFormElement* form = GetFormIfRegistered();
// remove the control from the hashtable as needed
@@ -2034,7 +2034,7 @@ void nsGenericHTMLFormElement::AfterSetAttr(
// Ensure that empty @form value clears the form owner.
ClearForm(true, false);
}
- } else if (HTMLFormElement* form = GetFormInternal()) {
+ } else if (HTMLFormElement* form = GetFormIfRegistered()) {
// add the control to the hashtable as needed
if (aName == nsGkAtoms::type) {
nsAutoString tmp;
diff --git a/dom/html/nsGenericHTMLElement.h b/dom/html/nsGenericHTMLElement.h
index 11b7af57dd4..08f5ca5a519 100644
--- a/dom/html/nsGenericHTMLElement.h
+++ b/dom/html/nsGenericHTMLElement.h
@@ -1120,6 +1120,10 @@ class nsGenericHTMLFormElement : public nsGenericHTMLElement {
return nullptr;
}
+ mozilla::dom::HTMLFormElement* GetFormIfRegistered() const {
+ return HasFlag(ADDED_TO_FORM) ? GetFormInternal() : nullptr;
+ }
+
virtual mozilla::dom::HTMLFieldSetElement* GetFieldSetInternal() const {
return nullptr;
}
Loading diff…
References
On This Page