Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionUse-after-free in the Storage: Bucket File System component
ComponentDOM
Bug ClassLogic Error
Tracker2058651
Fix commit6514c102f911 (firefox) +13/-6
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-13

Changed Functions

FunctionChangeNotes
if
dom/fs/parent/datamodel/FileSystemDatabaseManagerVersion002.cpp
modified

Files Changed

  • dom/fs/parent/FileSystemHashSource.cpp
  • dom/fs/parent/datamodel/FileSystemDatabaseManagerVersion002.cpp
diff --git a/dom/fs/parent/FileSystemHashSource.cpp b/dom/fs/parent/FileSystemHashSource.cpp
index c9d0f0b1230..58a7ecb8529 100644
--- a/dom/fs/parent/FileSystemHashSource.cpp
+++ b/dom/fs/parent/FileSystemHashSource.cpp
@@ -44,6 +44,8 @@ Result<EntryId, QMResult> FileSystemHashSource::GenerateHash(
 
 Result<Name, QMResult> FileSystemHashSource::EncodeHash(const FileId& aFileId) {
   MOZ_ASSERT(32u == aFileId.Value().Length());
+  QM_TRY(OkIf(32u == aFileId.Value().Length()),
+         Err(QMResult(NS_ERROR_DOM_NOT_FOUND_ERR)));
   nsCString encoded;
   base32encode(&aFileId.Value(), &encoded);
 
diff --git a/dom/fs/parent/datamodel/FileSystemDatabaseManagerVersion002.cpp b/dom/fs/parent/datamodel/FileSystemDatabaseManagerVersion002.cpp
index 8ac63a157f1..e638497cba4 100644
--- a/dom/fs/parent/datamodel/FileSystemDatabaseManagerVersion002.cpp
+++ b/dom/fs/parent/datamodel/FileSystemDatabaseManagerVersion002.cpp
@@ -42,7 +42,7 @@ Result<FileId, QMResult> GetFileId002(const FileSystemConnection& aConnection,
   QM_TRY(QM_TO_RESULT(stmt.BindEntryIdByName("entryId"_ns, aEntryId)));
   QM_TRY_UNWRAP(bool moreResults, stmt.ExecuteStep());
 
-  if (!moreResults) {
+  if (!moreResults || stmt.IsNullByColumn(/* Column */ 0u)) {
     return Err(QMResult(NS_ERROR_DOM_NOT_FOUND_ERR));
   }
 
@@ -94,7 +94,11 @@ nsresult RehashFile(const FileSystemConnection& aConnection,
                                        : insertNewFileAndTypeQuery;
 
   const nsLiteralCString updateFileMappingsQuery =
-      "UPDATE FileIds SET handle = :newId WHERE handle = :handle ;"_ns;
+      "UPDATE FileIds SET handle = :newId "
+      "FROM MainFiles WHERE MainFiles.handle = :handle "
+      "AND FileIds.fileId = MainFiles.fileId "
+      "AND FileIds.handle = :handle "
+      ";"_ns;
 
   const nsLiteralCString updateMainFilesQuery =
       "UPDATE MainFiles SET handle = :newId WHERE handle = :handle ;"_ns;
@@ -203,14 +207,14 @@ nsresult RehashDirectory(const FileSystemConnection& aConnection,
 
   const nsLiteralCString updateFileMappingsQuery =
       "UPDATE FileIds "
-      "SET handle = CASE WHEN replacement.isMain IS NULL THEN NULL "
-      "ELSE replacement.hash END "
+      "SET handle = replacement.hash "
       "FROM ( SELECT ParentChildHash.handle AS handle, "
       "ParentChildHash.hash AS hash, "
-      "MainFiles.handle AS isMain "
-      "FROM ParentChildHash LEFT JOIN MainFiles "
+      "MainFiles.fileId AS mainFileId "
+      "FROM ParentChildHash INNER JOIN MainFiles "
       "ON ParentChildHash.handle = MainFiles.handle ) AS replacement "
       "WHERE FileIds.handle = replacement.handle "
+      "AND FileIds.fileId = replacement.mainFileId "
       ";"_ns;
 
   const nsLiteralCString updateMainFilesQuery =
@@ -665,6 +669,7 @@ Result<FileId, QMResult> FileSystemDatabaseManagerVersion002::EnsureFileId(
                     })));
 
   if (maybeMainFileId) {
+    MOZ_ASSERT(!maybeMainFileId->IsEmpty());
     return *maybeMainFileId;
   }
 
Loading diff…