High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the Audio/Video component
ComponentDOM
Bug ClassLogic Error
Tracker2079058
Fix commit689d11b2db81 (firefox) +11/-4
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-27

Changed Functions

FunctionChangeNotes
if
dom/media/ChannelMediaResource.cpp
modified
for
dom/media/ChannelMediaResource.cpp
modified

Files Changed

  • dom/media/ChannelMediaResource.cpp
diff --git a/dom/media/ChannelMediaResource.cpp b/dom/media/ChannelMediaResource.cpp
index 713e845c693..a816597eadf 100644
--- a/dom/media/ChannelMediaResource.cpp
+++ b/dom/media/ChannelMediaResource.cpp
@@ -161,7 +161,7 @@ nsresult ChannelMediaResource::OnStartRequest(nsIRequest* aRequest,
 
   MediaDecoderOwner* owner = mCallback->GetMediaOwner();
   MOZ_DIAGNOSTIC_ASSERT(owner);
-  dom::HTMLMediaElement* element = owner->GetMediaElement();
+  RefPtr<dom::HTMLMediaElement> element = owner->GetMediaElement();
   MOZ_DIAGNOSTIC_ASSERT(element);
 
   nsresult status;
@@ -307,12 +307,17 @@ nsresult ChannelMediaResource::OnStartRequest(nsIRequest* aRequest,
   // Update principals before OnDataAvailable() putting the data in the cache.
   // This is important, we want to make sure all principals are updated before
   // any consumer can see the new data.
+  nsCOMPtr<nsIChannel> originalChannel = mChannel;
   UpdatePrincipal();
-  if (owner->HasError()) {
+  if (element->HasError()) {
     // Updating the principal resulted in an error. Abort the load.
     CloseChannel();
     return NS_OK;
   }
+  if (mChannel != originalChannel) {
+    LOG("Channel closed or replaced while updating the principal");
+    return NS_OK;
+  }
 
   mCacheStream.NotifyDataStarted(mLoadID, startOffset, seekable, length);
   mIsTransportSeekable = seekable;
@@ -323,7 +328,7 @@ nsresult ChannelMediaResource::OnStartRequest(nsIRequest* aRequest,
   mSuspendAgent.Delegate(mChannel);
 
   // Fires an initial progress event.
-  owner->DownloadProgressed();
+  element->DownloadProgressed();
 
   nsCOMPtr<nsIThreadRetargetableRequest> retarget;
   if ((retarget = do_QueryInterface(aRequest))) {
@@ -892,10 +897,12 @@ void ChannelMediaResource::UpdatePrincipal() {
                                                   getter_AddRefs(principal));
   if (nsContentUtils::CombineResourcePrincipals(&mSharedInfo->mPrincipal,
                                                 principal)) {
+    nsCOMPtr<nsIChannel> originalChannel = mChannel;
     for (auto* r : mSharedInfo->mResources) {
       r->CacheClientNotifyPrincipalChanged();
     }
-    if (!mChannel) {  // Sometimes cleared during NotifyPrincipalChanged()
+    // Sometimes cleared or replaced during CacheClientNotifyPrincipalChanged().
+    if (mChannel != originalChannel) {
       return;
     }
   }
Loading diff…