High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionIncorrect boundary conditions in the Audio/Video: cubeb component
ComponentToolkit
Bug ClassLogic Error
Tracker2042033
Fix commit2419f7747a23 (firefox) +96/-59
CISA KEVNot listed
CreditedTomoya Nakanishi
Disclosed2026-07-21

Files Changed

  • .cargo/config.toml.in
  • Cargo.lock
  • third_party/rust/audioipc2-client/.cargo-checksum.json
  • third_party/rust/audioipc2-client/src/context.rs
  • third_party/rust/audioipc2-client/src/stream.rs
  • third_party/rust/audioipc2-server/.cargo-checksum.json
  • third_party/rust/audioipc2-server/src/server.rs
  • third_party/rust/audioipc2/.cargo-checksum.json
  • third_party/rust/audioipc2/src/messages.rs
  • toolkit/library/rust/shared/Cargo.toml
diff --git a/.cargo/config.toml.in b/.cargo/config.toml.in
index 57e58ed55db..2f0a7b9fe08 100644
--- a/.cargo/config.toml.in
+++ b/.cargo/config.toml.in
@@ -65,9 +65,9 @@ git = "https://github.com/martinthomson/ohttp"
 rev = "600931b5a1e947776cbaad931ed78f1e89005352"
 replace-with = "vendored-sources"
 
-[source."git+https://github.com/mozilla/audioipc?rev=042d48dc5932ced772c2bf20a2aef2845fd6ec85"]
+[source."git+https://github.com/mozilla/audioipc?rev=c9dcbaee1624daad2fa6b1445fd047efde4f1ec0"]
 git = "https://github.com/mozilla/audioipc"
-rev = "042d48dc5932ced772c2bf20a2aef2845fd6ec85"
+rev = "c9dcbaee1624daad2fa6b1445fd047efde4f1ec0"
 replace-with = "vendored-sources"
 
 [source."git+https://github.com/mozilla/authenticator-rs?tag=v0.6.0"]
diff --git a/Cargo.lock b/Cargo.lock
index ca556fa40c6..b643010d068 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -365,7 +365,7 @@ dependencies = [
 [[package]]
 name = "audioipc2"
 version = "0.6.0"
-source = "git+https://github.com/mozilla/audioipc?rev=042d48dc5932ced772c2bf20a2aef2845fd6ec85#042d48dc5932ced772c2bf20a2aef2845fd6ec85"
+source = "git+https://github.com/mozilla/audioipc?rev=c9dcbaee1624daad2fa6b1445fd047efde4f1ec0#c9dcbaee1624daad2fa6b1445fd047efde4f1ec0"
 dependencies = [
  "arrayvec",
  "ashmem",
@@ -391,7 +391,7 @@ dependencies = [
 [[package]]
 name = "audioipc2-client"
 version = "0.6.0"
-source = "git+https://github.com/mozilla/audioipc?rev=042d48dc5932ced772c2bf20a2aef2845fd6ec85#042d48dc5932ced772c2bf20a2aef2845fd6ec85"
+source = "git+https://github.com/mozilla/audioipc?rev=c9dcbaee1624daad2fa6b1445fd047efde4f1ec0#c9dcbaee1624daad2fa6b1445fd047efde4f1ec0"
 dependencies = [
  "audio_thread_priority",
  "audioipc2",
@@ -402,7 +402,7 @@ dependencies = [
 [[package]]
 name = "audioipc2-server"
 version = "0.6.0"
-source = "git+https://github.com/mozilla/audioipc?rev=042d48dc5932ced772c2bf20a2aef2845fd6ec85#042d48dc5932ced772c2bf20a2aef2845fd6ec85"
+source = "git+https://github.com/mozilla/audioipc?rev=c9dcbaee1624daad2fa6b1445fd047efde4f1ec0#c9dcbaee1624daad2fa6b1445fd047efde4f1ec0"
 dependencies = [
  "audio_thread_priority",
  "audioipc2",
diff --git a/third_party/rust/audioipc2-client/.cargo-checksum.json b/third_party/rust/audioipc2-client/.cargo-checksum.json
index 7661d4ed4cc..5b8ce76ed95 100644
--- a/third_party/rust/audioipc2-client/.cargo-checksum.json
+++ b/third_party/rust/audioipc2-client/.cargo-checksum.json
@@ -1 +1 @@
-{"files":{"Cargo.toml":"8041e238fb1492f52e6f6c34ba43496208ebbf2acc3dd87faaac0c7f0af1dc01","cbindgen.toml":"fb6abe1671497f432a06e40b1db7ed7cd2cceecbd9a2382193ad7534e8855e34","src/context.rs":"241233793a343f930f868327a62903f0ab845a17ae44b0afa809dcd245641a16","src/lib.rs":"0322bba9529c81c891bc2c033d402590058014da0df0730dbf9532380c2dabe8","src/send_recv.rs":"cd396a704f205d4ef680f484461a065aa29f624603d5031f9973779826fb3c19","src/stream.rs":"4f08831749d5cb393db6bfbf0c66cdc71e9a06418927929dadce4737a391c4b2"},"package":null}
\ No newline at end of file
+{"files":{"Cargo.toml":"8041e238fb1492f52e6f6c34ba43496208ebbf2acc3dd87faaac0c7f0af1dc01","cbindgen.toml":"fb6abe1671497f432a06e40b1db7ed7cd2cceecbd9a2382193ad7534e8855e34","src/context.rs":"c351b782e9bb83a1fbc5127e07a4d06c59978256bb0dc265df256eb948a6cf4e","src/lib.rs":"0322bba9529c81c891bc2c033d402590058014da0df0730dbf9532380c2dabe8","src/send_recv.rs":"cd396a704f205d4ef680f484461a065aa29f624603d5031f9973779826fb3c19","src/stream.rs":"d7d4967c8ef760a58592aff23157357646528c1c83c9de394e1f9c8043f72a81"},"package":null}
\ No newline at end of file
diff --git a/third_party/rust/audioipc2-client/src/context.rs b/third_party/rust/audioipc2-client/src/context.rs
index 7025ee2c630..40790965bab 100644
--- a/third_party/rust/audioipc2-client/src/context.rs
+++ b/third_party/rust/audioipc2-client/src/context.rs
@@ -297,7 +297,7 @@ impl ContextOps for ClientContext {
         let input_stream_params = input_stream_params.map(messages::StreamParams::from);
         let output_stream_params = output_stream_params.map(messages::StreamParams::from);
 
-        let init_params = messages::StreamInitParams {
+        let params = messages::StreamCreateParams {
             stream_name,
             input_device: input_device as usize,
             input_stream_params,
@@ -305,7 +305,7 @@ impl ContextOps for ClientContext {
             output_stream_params,
             latency_frames,
         };
-        stream::init(self, init_params, data_callback, state_callback, user_ptr)
+        stream::init(self, params, data_callback, state_callback, user_ptr)
     }
 
     fn register_device_collection_changed(
diff --git a/third_party/rust/audioipc2-client/src/stream.rs b/third_party/rust/audioipc2-client/src/stream.rs
index bfa9c9613d9..07378c060f4 100644
--- a/third_party/rust/audioipc2-client/src/stream.rs
+++ b/third_party/rust/audioipc2-client/src/stream.rs
@@ -5,7 +5,6 @@
 
 use crate::ClientContext;
 use crate::{assert_not_in_callback, run_in_callback};
-use audioipc::messages::StreamCreateParams;
 use audioipc::messages::{self, CallbackReq, CallbackResp, ClientMessage, ServerMessage};
 use audioipc::shm::SharedMem;
 use audioipc::{rpccore, sys};
@@ -166,27 +165,25 @@ impl rpccore::Server for CallbackServer {
 impl<'ctx> ClientStream<'ctx> {
     fn init(
         ctx: &'ctx ClientContext,
-        init_params: messages::StreamInitParams,
+        params: messages::StreamCreateParams,
         data_callback: ffi::cubeb_data_callback,
         state_callback: ffi::cubeb_state_callback,
         user_ptr: *mut c_void,
     ) -> Result<Stream> {
         assert_not_in_callback();
-        let input_frame_size = init_params
+        let has_input = params.input_stream_params.is_some();
+        let has_output = params.output_stream_params.is_some();
+        let input_frame_size = params
             .input_stream_params
             .as_ref()
             .map(messages::StreamParams::frame_size_in_bytes);
-        let output_frame_size = init_params
+        let output_frame_size = params
             .output_stream_params
             .as_ref()
             .map(messages::StreamParams::frame_size_in_bytes);
 
         let rpc = ctx.rpc();
-        let create_params = StreamCreateParams {
-            input_stream_params: init_params.input_stream_params,
-            output_stream_params: init_params.output_stream_params,
-        };
-        let mut data = send_recv!(rpc, StreamCreate(create_params) => StreamCreated())?;
+        let mut data = send_recv!(rpc, StreamCreate(params) => StreamCreated())?;
 
         debug!(
             "token = {}, handle = {:?} area_size = {:?}",
@@ -205,10 +202,7 @@ impl<'ctx> ClientStream<'ctx> {
                 }
             };
 
-        let duplex_input = if let (Some(_), Some(_)) = (
-            init_params.input_stream_params,
-            init_params.output_stream_params,
-        ) {
+        let duplex_input = if has_input && has_output {
             let mut duplex_input = Vec::new();
             match duplex_input.try_reserve_exact(data.shm_area_size) {
                 Ok(()) => Some(duplex_input),
@@ -224,8 +218,7 @@ impl<'ctx> ClientStream<'ctx> {
             None
         };
 
-        let mut stream =
-            send_recv!(rpc, StreamInit(data.token, init_params) => StreamInitialized())?;
+        let mut stream = send_recv!(rpc, StreamInit(data.token) => StreamInitialized())?;
         let stream = unsafe { sys::Pipe::from_raw_handle(stream.take_handle()) };
 
         let user_data = user_ptr as usize;
@@ -367,12 +360,12 @@ impl StreamOps for ClientStream<'_> {
 
 pub fn init(
     ctx: &ClientContext,
-    init_params: messages::StreamInitParams,
+    params: messages::StreamCreateParams,
     data_callback: ffi::cubeb_data_callback,
     state_callback: ffi::cubeb_state_callback,
     user_ptr: *mut c_void,
 ) -> Result<Stream> {
-    let stm = ClientStream::init(ctx, init_params, data_callback, state_callback, user_ptr)?;
+    let stm = ClientStream::init(ctx, params, data_callback, state_callback, user_ptr)?;
     debug_assert_eq!(stm.user_ptr(), user_ptr);
     Ok(stm)
 }
diff --git a/third_party/rust/audioipc2-server/.cargo-checksum.json b/third_party/rust/audioipc2-server/.cargo-checksum.json
index a5aa180bae6..640ba1b6f06 100644
--- a/third_party/rust/audioipc2-server/.cargo-checksum.json
+++ b/third_party/rust/audioipc2-server/.cargo-checksum.json
@@ -1 +1 @@
-{"files":{"Cargo.toml":"cb7cde50cf3ed08b5cd40d8f118d7101ec863942d506eebc26595662a7cc5b58","cbindgen.toml":"fb6abe1671497f432a06e40b1db7ed7cd2cceecbd9a2382193ad7534e8855e34","src/lib.rs":"a19c1bad94e16a0cfcd1e93c25b97bf58cc00e9666b5c31652d8a2242decb36c","src/server.rs":"1a8c83c67f4bb834646b55279e4a6d473d0b1ad1033108bc3a8399471e6e0652"},"package":null}
\ No newline at end of file
+{"files":{"Cargo.toml":"cb7cde50cf3ed08b5cd40d8f118d7101ec863942d506eebc26595662a7cc5b58","cbindgen.toml":"fb6abe1671497f432a06e40b1db7ed7cd2cceecbd9a2382193ad7534e8855e34","src/lib.rs":"a19c1bad94e16a0cfcd1e93c25b97bf58cc00e9666b5c31652d8a2242decb36c","src/server.rs":"28d494e2d4a6ad673f77912578179eb7b1b8b927d7fd63048d099284d03aeda7"},"package":null}
\ No newline at end of file
diff --git a/third_party/rust/audioipc2-server/src/server.rs b/third_party/rust/audioipc2-server/src/server.rs
index 90337418abf..eb550c83d07 100644
--- a/third_party/rust/audioipc2-server/src/server.rs
+++ b/third_party/rust/audioipc2-server/src/server.rs
@@ -9,7 +9,7 @@ use audioipc::messages::SerializableHandle;
 use audioipc::messages::{
     CallbackReq, CallbackResp, ClientMessage, Device, DeviceCollectionReq, DeviceCollectionResp,
     DeviceInfo, RegisterDeviceCollectionChanged, ServerMessage, StreamCreate, StreamCreateParams,
-    StreamInitParams, StreamParams,
+    StreamParams,
 };
 use audioipc::shm::SharedMem;
 use audioipc::{ipccore, rpccore, sys, PlatformHandle};
@@ -356,10 +356,61 @@ fn get_shm_id() -> String {
     )
 }
 
+fn validate_stream_params(p: &StreamParams) -> cubeb::Result<()> {
+    const MAX_CHANNELS: u32 = u8::MAX as u32;
+    const MIN_RATE: u32 = 1_000;
+    const MAX_RATE: u32 = 768_000;
+
+    let valid_format = matches!(
+        p.format,
+        ffi::CUBEB_SAMPLE_S16LE
+            | ffi::CUBEB_SAMPLE_S16BE
+            | ffi::CUBEB_SAMPLE_FLOAT32LE
+            | ffi::CUBEB_SAMPLE_FLOAT32BE
+    );
+
Loading diff…