Firefox · Core
CVE-2026-117900
Logic Error in Core
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifeditor/libeditor/HTMLAnonymousNodeEditor.cpp |
modified |
Files Changed
editor/libeditor/HTMLAnonymousNodeEditor.cpp
Patch
diff --git a/editor/libeditor/HTMLAnonymousNodeEditor.cpp b/editor/libeditor/HTMLAnonymousNodeEditor.cpp
index 67064d4bbee..6ebea711b1c 100644
--- a/editor/libeditor/HTMLAnonymousNodeEditor.cpp
+++ b/editor/libeditor/HTMLAnonymousNodeEditor.cpp
@@ -172,8 +172,12 @@ ManualNACPtr HTMLEditor::CreateAnonymousElement(nsAtom* aTag,
return nullptr;
}
- if (NS_WARN_IF(!GetDocument())) {
- return nullptr;
+ {
+ Document* const doc = GetDocument();
+ if (NS_WARN_IF(!doc) ||
+ NS_WARN_IF(aParentContent.GetComposedDoc() != doc)) {
+ return nullptr;
+ }
}
RefPtr<PresShell> presShell = GetPresShell();
@@ -563,9 +567,12 @@ nsresult HTMLEditor::GetPositionAndDimensions(Element& aElement, int32_t& aX,
nsAutoString positionValue;
DebugOnly<nsresult> rvIgnored = CSSEditUtils::GetComputedProperty(
aElement, *nsGkAtoms::position, positionValue);
- if (NS_WARN_IF(Destroyed())) {
+ if (NS_WARN_IF(Destroyed())) [[unlikely]] {
return NS_ERROR_EDITOR_DESTROYED;
}
+ if (NS_WARN_IF(aElement.OwnerDoc() != GetDocument())) [[unlikely]] {
+ return NS_ERROR_EDITOR_UNEXPECTED_DOM_TREE;
+ }
NS_WARNING_ASSERTION(NS_SUCCEEDED(rvIgnored),
"CSSEditUtils::GetComputedProperty(nsGkAtoms::"
"position) failed, but ignored");
@@ -579,7 +586,13 @@ nsresult HTMLEditor::GetPositionAndDimensions(Element& aElement, int32_t& aX,
// Get the all the computed css styles attached to the element node
RefPtr<nsComputedDOMStyle> computedDOMStyle =
CSSEditUtils::GetComputedStyle(&aElement);
- if (NS_WARN_IF(!computedDOMStyle)) {
+ if (NS_WARN_IF(Destroyed())) [[unlikely]] {
+ return NS_ERROR_EDITOR_DESTROYED;
+ }
+ if (NS_WARN_IF(aElement.OwnerDoc() != GetDocument())) [[unlikely]] {
+ return NS_ERROR_EDITOR_UNEXPECTED_DOM_TREE;
+ }
+ if (NS_WARN_IF(!computedDOMStyle)) [[unlikely]] {
return NS_ERROR_FAILURE;
}
@@ -597,7 +610,7 @@ nsresult HTMLEditor::GetPositionAndDimensions(Element& aElement, int32_t& aX,
mResizedObjectIsAbsolutelyPositioned = false;
RefPtr<nsGenericHTMLElement> htmlElement =
nsGenericHTMLElement::FromNode(aElement);
- if (!htmlElement) {
+ if (NS_WARN_IF(!htmlElement)) [[unlikely]] {
return NS_ERROR_NULL_POINTER;
}
DebugOnly<nsresult> rvIgnored = GetElementOrigin(aElement, aX, aY);
Loading diff…
References
On This Page