Firefox · DOM
CVE-2026-117957
Logic Error in DOM
Overview
Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/media/webrtc/transport/third_party/nICEr/src/stun/stun_proc.cpp |
modified |
Files Changed
dom/media/webrtc/transport/third_party/nICEr/nicer.gypdom/media/webrtc/transport/third_party/nICEr/src/stun/stun.hdom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.hdom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.hdom/media/webrtc/transport/third_party/nICEr/src/stun/stun_codec.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/stun_hint.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.cppdom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.hdom/media/webrtc/transport/third_party/nICEr/src/stun/stun_proc.cpp
Patch
diff --git a/dom/media/webrtc/transport/third_party/nICEr/nicer.gyp b/dom/media/webrtc/transport/third_party/nICEr/nicer.gyp
index b617244f2fd..4bfd7d62d1f 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/nicer.gyp
+++ b/dom/media/webrtc/transport/third_party/nICEr/nicer.gyp
@@ -120,7 +120,6 @@
'USE_TURN',
'USE_ICE',
'USE_RFC_3489_BACKWARDS_COMPATIBLE',
- 'USE_STUND_0_96',
'USE_STUN_PEDANTIC',
'USE_TURN',
'NR_SOCKET_IS_VOID_PTR',
@@ -183,7 +182,6 @@
'USE_ICE',
'USE_TURN',
'USE_RFC_3489_BACKWARDS_COMPATIBLE',
- 'USE_STUND_0_96',
'USE_STUN_PEDANTIC',
'_CRT_SECURE_NO_WARNINGS',
'__UNUSED__=',
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun.h b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun.h
index 2ea50172053..905105c4a27 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun.h
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun.h
@@ -89,10 +89,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
/* for backwards compatibility with obsolete versions of the STUN spec */
#define NR_STUN_ATTR_OLD_XOR_MAPPED_ADDRESS 0x8020
-#ifdef USE_STUND_0_96
-#define NR_STUN_ATTR_OLD_CHANGE_REQUEST 0x0003
-#endif /* USE_STUND_0_96 */
-
#ifdef USE_RFC_3489_BACKWARDS_COMPATIBLE
/* for backwards compatibility with obsolete versions of the STUN spec */
#define NR_STUN_ATTR_OLD_PASSWORD 0x0007
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.cpp
index a40c4adb705..2e4cc8ad42b 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.cpp
@@ -78,17 +78,6 @@ nr_stun_form_request_or_indication(int mode, int msg_type, nr_stun_message **msg
case NR_STUN_MODE_STUN_NO_AUTH:
req->header.magic_cookie = NR_STUN_MAGIC_COOKIE;
break;
-
-#ifdef USE_STUND_0_96
- case NR_STUN_MODE_STUND_0_96:
- req->header.magic_cookie = NR_STUN_MAGIC_COOKIE2;
-
- /* actually, stund 0.96 just ignores the fingerprint
- * attribute, but don't bother to send it */
-
- break;
-#endif /* USE_STUND_0_96 */
-
}
*msg = req;
@@ -189,31 +178,6 @@ nr_stun_build_keepalive(nr_stun_client_stun_keepalive_params *params, nr_stun_me
return _status;
}
-#ifdef USE_STUND_0_96
-int
-nr_stun_build_req_stund_0_96(nr_stun_client_stun_binding_request_stund_0_96_params *params, nr_stun_message **msg)
-{
- int r,_status;
- nr_stun_message *req = 0;
-
- if ((r=nr_stun_form_request_or_indication(NR_STUN_MODE_STUND_0_96, NR_STUN_MSG_BINDING_REQUEST, &req)))
- ABORT(r);
-
- if ((r=nr_stun_message_add_change_request_attribute(req, 0)))
- ABORT(r);
-
- assert(! nr_stun_message_has_attribute(req, NR_STUN_ATTR_USERNAME, 0));
- assert(! nr_stun_message_has_attribute(req, NR_STUN_ATTR_MESSAGE_INTEGRITY, 0));
-
- *msg = req;
-
- _status=0;
- abort:
- if (_status) nr_stun_message_destroy(&req);
- return _status;
-}
-#endif /* USE_STUND_0_96 */
-
#ifdef USE_ICE
int
nr_stun_build_use_candidate(nr_stun_client_ice_binding_request_params *params, nr_stun_message **msg)
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.h b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.h
index dd53ef2fb17..35a22e039d5 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.h
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.h
@@ -37,9 +37,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#include "stun.h"
#define NR_STUN_MODE_STUN 1
-#ifdef USE_STUND_0_96
-#define NR_STUN_MODE_STUND_0_96 2 /* backwards compatibility mode */
-#endif /* USE_STUND_0_96 */
#define NR_STUN_MODE_STUN_NO_AUTH 3
int nr_stun_form_request_or_indication(int mode, int msg_type, nr_stun_message **msg);
@@ -65,17 +62,6 @@ typedef struct nr_stun_client_stun_keepalive_params_ {
int nr_stun_build_keepalive(nr_stun_client_stun_keepalive_params *params, nr_stun_message **msg);
-#ifdef USE_STUND_0_96
-typedef struct nr_stun_client_stun_binding_request_stund_0_96_params_ {
-#ifdef WIN32 // silly VC++ gives error if no members
- int dummy;
-#endif
-} nr_stun_client_stun_binding_request_stund_0_96_params;
-
-int nr_stun_build_req_stund_0_96(nr_stun_client_stun_binding_request_stund_0_96_params *params, nr_stun_message **msg);
-#endif /* USE_STUND_0_96 */
-
-
#ifdef USE_ICE
typedef struct nr_stun_client_ice_binding_request_params_ {
char *username;
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.cpp
index ee64d7a74c9..f2c1926947e 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.cpp
@@ -305,13 +305,6 @@ static int nr_stun_client_send_request(nr_stun_client_ctx *ctx)
if ((r=nr_stun_build_keepalive(&ctx->params.stun_keepalive, &ctx->request)))
ABORT(r);
break;
-#ifdef USE_STUND_0_96
- case NR_STUN_CLIENT_MODE_BINDING_REQUEST_STUND_0_96:
- if ((r=nr_stun_build_req_stund_0_96(&ctx->params.stun_binding_request_stund_0_96, &ctx->request)))
- ABORT(r);
- break;
-#endif /* USE_STUND_0_96 */
-
#ifdef USE_ICE
case NR_ICE_CLIENT_MODE_USE_CANDIDATE:
if ((r=nr_stun_build_use_candidate(&ctx->params.ice_binding_request, &ctx->request)))
@@ -475,12 +468,6 @@ int nr_stun_client_process_response(nr_stun_client_ctx *ctx, UCHAR *msg, int len
fail_on_error = 1;
break;
- case NR_STUN_CLIENT_MODE_BINDING_REQUEST_STUND_0_96:
- /* If the STUN server responds with an error, give up, since we don't
- * want to delay the completion of gathering. */
- fail_on_error = 1;
- break;
-
#ifdef USE_ICE
case NR_ICE_CLIENT_MODE_BINDING_REQUEST:
/* We do not set fail_on_error here. The error might be transient, and
@@ -665,15 +652,6 @@ int nr_stun_client_process_response(nr_stun_client_ctx *ctx, UCHAR *msg, int len
mapped_addr = &ctx->results.stun_binding_response.mapped_addr;
break;
- case NR_STUN_CLIENT_MODE_BINDING_REQUEST_STUND_0_96:
- if (! nr_stun_message_has_attribute(ctx->response, NR_STUN_ATTR_MAPPED_ADDRESS, 0) && ! nr_stun_message_has_attribute(ctx->response, NR_STUN_ATTR_XOR_MAPPED_ADDRESS, 0)) {
- r_log(NR_LOG_STUN,LOG_WARNING,"STUN-CLIENT(%s): No MAPPED-ADDRESS",ctx->label);
- ABORT(R_BAD_DATA);
- }
-
- mapped_addr = &ctx->results.stun_binding_response_stund_0_96.mapped_addr;
- break;
-
#ifdef USE_ICE
case NR_ICE_CLIENT_MODE_BINDING_REQUEST:
if (! nr_stun_message_has_attribute(ctx->response, NR_STUN_ATTR_XOR_MAPPED_ADDRESS, 0)) {
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.h b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.h
index 7c9a176adf4..ea605ef9327 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.h
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.h
@@ -60,9 +60,6 @@ typedef union nr_stun_client_params_ {
nr_stun_client_stun_binding_request_params stun_binding_request;
nr_stun_client_stun_keepalive_params stun_keepalive;
-#ifdef USE_STUND_0_96
- nr_stun_client_stun_binding_request_stund_0_96_params stun_binding_request_stund_0_96;
-#endif /* USE_STUND_0_96 */
#ifdef USE_ICE
nr_stun_client_ice_binding_request_params ice_binding_request;
@@ -81,10 +78,6 @@ typedef struct nr_stun_client_stun_binding_response_results_ {
nr_transport_addr mapped_addr;
} nr_stun_client_stun_binding_response_results;
-typedef struct nr_stun_client_stun_binding_response_stund_0_96_results_ {
- nr_transport_addr mapped_addr;
-} nr_stun_client_stun_binding_response_stund_0_96_results;
-
#ifdef USE_ICE
typedef struct nr_stun_client_ice_use_candidate_results_ {
#ifdef WIN32 // silly VC++ gives error if no members
@@ -116,7 +109,6 @@ typedef struct nr_stun_client_permission_response_results_ {
typedef union nr_stun_client_results_ {
nr_stun_client_stun_binding_response_results stun_binding_response;
- nr_stun_client_stun_binding_response_stund_0_96_results stun_binding_response_stund_0_96;
#ifdef USE_ICE
nr_stun_client_ice_use_candidate_results ice_use_candidate;
@@ -144,7 +136,6 @@ struct nr_stun_client_ctx_ {
#define NR_STUN_CLIENT_MODE_BINDING_REQUEST_LONG_TERM_AUTH 2
#define NR_STUN_CLIENT_MODE_BINDING_REQUEST_NO_AUTH 3
#define NR_STUN_CLIENT_MODE_KEEPALIVE 4
-#define NR_STUN_CLIENT_MODE_BINDING_REQUEST_STUND_0_96 5
#ifdef USE_ICE
#define NR_ICE_CLIENT_MODE_USE_CANDIDATE 10
#define NR_ICE_CLIENT_MODE_BINDING_REQUEST 11
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_codec.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_codec.cpp
index 2e8ef61741c..7ab40b91983 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_codec.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_codec.cpp
@@ -1189,9 +1189,6 @@ nr_stun_attr_codec nr_stun_attr_codec_xor_peer_address = {
static nr_stun_attr_info attrs[] = {
NR_ADD_STUN_ATTRIBUTE(NR_STUN_ATTR_ALTERNATE_SERVER, "ALTERNATE-SERVER", nr_stun_attr_codec_addr, 0)
-#ifdef USE_STUND_0_96
- NR_ADD_STUN_ATTRIBUTE(NR_STUN_ATTR_OLD_CHANGE_REQUEST, "CHANGE-REQUEST", nr_stun_attr_codec_UINT4, 0)
-#endif
NR_ADD_STUN_ATTRIBUTE(NR_STUN_ATTR_ERROR_CODE, "ERROR-CODE", nr_stun_attr_codec_error_code, nr_stun_attr_error_code_illegal)
NR_ADD_STUN_ATTRIBUTE(NR_STUN_ATTR_FINGERPRINT, "FINGERPRINT", nr_stun_attr_codec_fingerprint, 0)
NR_ADD_STUN_ATTRIBUTE(NR_STUN_ATTR_MAPPED_ADDRESS, "MAPPED-ADDRESS", nr_stun_attr_codec_addr, 0)
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_hint.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_hint.cpp
index b59c543269f..6faf6784fb7 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_hint.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_hint.cpp
@@ -54,7 +54,6 @@ int
nr_is_stun_message(UCHAR *buf, size_t len)
{
const UINT4 cookie = htonl(NR_STUN_MAGIC_COOKIE);
- const UINT4 cookie2 = htonl(NR_STUN_MAGIC_COOKIE2);
UINT2 type;
nr_stun_encoded_attribute* attr;
unsigned int attrLen;
@@ -111,12 +110,6 @@ nr_is_stun_message(UCHAR *buf, size_t len)
break;
}
- if (!memcmp(&cookie2, &buf[4], sizeof(UINT4))) {
- /* return here because if it's an old-style message then there will
- * not be a fingerprint in the message */
- return 1;
- }
-
if (memcmp(&cookie, &buf[4], sizeof(UINT4)))
return 0;
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.cpp
index 1f0fb76a257..dad5b4ac9ed 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.cpp
@@ -353,12 +353,3 @@ NR_STUN_MESSAGE_ADD_ATTRIBUTE(
#endif /* USE_TURN */
-#ifdef USE_STUND_0_96
-int
-nr_stun_message_add_change_request_attribute(nr_stun_message *msg, UINT4 change_request)
-NR_STUN_MESSAGE_ADD_ATTRIBUTE(
- NR_STUN_ATTR_OLD_CHANGE_REQUEST,
- { attr->u.change_request = change_request; }
-)
-#endif /* USE_STUND_0_96 */
-
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.h b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.h
index d5a283e4857..2e1d79b817e 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.h
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.h
@@ -53,7 +53,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#define NR_STUN_MAX_MESSAGE_SIZE 2048
#define NR_STUN_MAGIC_COOKIE 0x2112A442
-#define NR_STUN_MAGIC_COOKIE2 0xc5cb4e1d /* used recognize old stun messages */
typedef struct { UCHAR octet[12]; } UINT12;
@@ -128,10 +127,6 @@ typedef struct nr_stun_message_attribute_ {
nr_stun_attr_data data;
#endif /* USE_TURN */
-#ifdef USE_STUND_0_96
- UINT4 change_request;
-#endif /* USE_STUND_0_96 */
-
/* make sure there's enough room here to place any possible
* attribute */
UCHAR largest_possible_attribute[NR_STUN_MAX_MESSAGE_SIZE];
@@ -200,9 +195,5 @@ int
nr_stun_message_add_xor_peer_address_attribute(nr_stun_message *msg, nr_transport_addr *peer_address);
#endif /* USE_TURN */
-#ifdef USE_STUND_0_96
-int nr_stun_message_add_change_request_attribute(nr_stun_message *msg, UINT4 change_request);
-#endif /* USE_STUND_0_96 */
-
#endif
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_proc.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_proc.cpp
index 51800283c02..e621084cf92 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_proc.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_proc.cpp
@@ -61,8 +61,7 @@ nr_stun_receive_message(nr_stun_message *req, nr_stun_message *msg)
/* if this message was generated by an RFC 3489 impementation,
* the call to nr_is_stun_message will fail, so skip that
* check and puke elsewhere if the message can't be decoded */
- if (msg->header.magic_cookie == NR_STUN_MAGIC_COOKIE
- || msg->header.magic_cookie == NR_STUN_MAGIC_COOKIE2) {
+ if (msg->header.magic_cookie == NR_STUN_MAGIC_COOKIE) {
#endif /* USE_RFC_3489_BACKWARDS_COMPATIBLE */
if (!nr_is_stun_message(msg->buffer, msg->length)) {
r_log(NR_LOG_STUN, LOG_WARNING, "Not a STUN message");
@@ -108,12 +107,6 @@ nr_stun_receive_message(nr_stun_message *req, nr_stun_message *msg)
break;
-#ifdef USE_STUND_0_96
- case NR_STUN_MAGIC_COOKIE2:
- /* nothing to check in this case */
- break;
-#endif /* USE_STUND_0_96 */
-
default:
#ifdef USE_RFC_3489_BACKWARDS_COMPATIBLE
/* in RFC 3489 there is no magic cookie, it's part of the transaction ID */
@@ -325,12 +318,6 @@ nr_stun_receive_request_or_indication_short_term_auth(nr_stun_message *msg,
}
break;
-
-#ifdef USE_STUND_0_96
- case NR_STUN_MAGIC_COOKIE2:
- /* nothing to check in this case */
- break;
-#endif /* USE_STUND_0_96 */
}
_status=0;
@@ -361,12 +348,6 @@ nr_stun_receive_response_short_term_auth(nr_stun_message *res)
}
break;
-
-#ifdef USE_STUND_0_96
- case NR_STUN_MAGIC_COOKIE2:
- /* nothing to check in this case */
- break;
-#endif /* USE_STUND_0_96 */
}
_status=0;
@@ -483,12 +464,6 @@ nr_stun_receive_request_long_term_auth(nr_stun_message *req, nr_stun_server_ctx
}
break;
-
-#ifdef USE_STUND_0_96
- case NR_STUN_MAGIC_COOKIE2:
- /* nothing to do in this case */
- break;
-#endif /* USE_STUND_0_96 */
}
_status=0;
@@ -539,12 +514,6 @@ nr_stun_receive_response_long_term_auth(nr_stun_message *res, nr_stun_client_ctx
}
break;
-
-#ifdef USE_STUND_0_96
- case NR_STUN_MAGIC_COOKIE2:
- /* nothing to check in this case */
- break;
-#endif /* USE_STUND_0_96 */
}
_status=0;
Loading diff…
References
On This Page