Firefox · Networking
CVE-2026-12297
Sandbox Escape in Networking
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifnetwerk/base/nsStandardURL.cpp |
modified | |
ifnetwerk/base/nsStandardURL.h |
modified |
Files Changed
netwerk/base/nsStandardURL.cppnetwerk/base/nsStandardURL.h
Patch
diff --git a/netwerk/base/nsStandardURL.cpp b/netwerk/base/nsStandardURL.cpp
index 23bcb9d713e..f1ce9e203c7 100644
--- a/netwerk/base/nsStandardURL.cpp
+++ b/netwerk/base/nsStandardURL.cpp
@@ -3730,6 +3730,10 @@ bool nsStandardURL::Deserialize(const URIParams& aParams) {
NS_ENSURE_TRUE(isSubSegment(mQuery, mPath), false);
NS_ENSURE_TRUE(isSubSegment(mRef, mPath), false);
+ if (mAuthority.mLen >= 0 && mPath.mLen >= 0) {
+ NS_ENSURE_TRUE(mPath.mPos == mAuthority.mPos + mAuthority.mLen, false);
+ }
+
if (!IsValid()) {
return false;
}
diff --git a/netwerk/base/nsStandardURL.h b/netwerk/base/nsStandardURL.h
index 3049cf6dd6f..79760da0268 100644
--- a/netwerk/base/nsStandardURL.h
+++ b/netwerk/base/nsStandardURL.h
@@ -412,6 +412,9 @@ class nsStandardURL : public nsIFileURL,
}
[[nodiscard]] NS_IMETHOD Finalize(nsIURI** aURI) override {
+ if (!BaseURIMutator<T>::mURI) {
+ return NS_ERROR_NULL_POINTER;
+ }
BaseURIMutator<T>::mURI.forget(aURI);
return NS_OK;
}
Loading diff…
References
On This Page