Firefox · DOM
CVE-2026-16383
Logic Error in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/webtransport/api/WebTransport.cpp |
modified |
Files Changed
dom/webtransport/api/WebTransport.cppdom/webtransport/parent/WebTransportParent.cppdom/webtransport/parent/WebTransportParent.hipc/glue/BackgroundParentImpl.cppipc/glue/BackgroundParentImpl.hipc/glue/PBackground.ipdl
Patch
diff --git a/dom/webtransport/api/WebTransport.cpp b/dom/webtransport/api/WebTransport.cpp
index 332dba455d1..23525bc5884 100644
--- a/dom/webtransport/api/WebTransport.cpp
+++ b/dom/webtransport/api/WebTransport.cpp
@@ -287,13 +287,12 @@ void WebTransport::Init(const GlobalObject& aGlobal, const nsAString& aURL,
return;
}
- if (mGlobal->GetClientInfo().isNothing()) {
- aError.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
- return;
- }
- IPCClientInfo ipcClientInfo = mGlobal->GetClientInfo().ref().ToIPC();
-
nsCOMPtr<nsIPrincipal> principal = mGlobal->PrincipalOrNull();
+ mozilla::Maybe<IPCClientInfo> ipcClientInfo;
+
+ if (mGlobal->GetClientInfo().isSome()) {
+ ipcClientInfo = mozilla::Some(mGlobal->GetClientInfo().ref().ToIPC());
+ }
nsPIDOMWindowInner* window = mGlobal->GetAsInnerWindow();
if (window) {
diff --git a/dom/webtransport/parent/WebTransportParent.cpp b/dom/webtransport/parent/WebTransportParent.cpp
index ff25539eb8f..2a56118b34d 100644
--- a/dom/webtransport/parent/WebTransportParent.cpp
+++ b/dom/webtransport/parent/WebTransportParent.cpp
@@ -33,9 +33,9 @@ WebTransportParent::~WebTransportParent() {
void WebTransportParent::Create(
const nsAString& aURL, nsIPrincipal* aPrincipal,
- const uint64_t& aBrowsingContextID, const IPCClientInfo& aClientInfo,
- const bool& aDedicated, const bool& aRequireUnreliable,
- const uint32_t& aCongestionControl,
+ const uint64_t& aBrowsingContextID,
+ const mozilla::Maybe<IPCClientInfo>& aClientInfo, const bool& aDedicated,
+ const bool& aRequireUnreliable, const uint32_t& aCongestionControl,
nsTArray<WebTransportHash>&& aServerCertHashes,
Endpoint<PWebTransportParent>&& aParentEndpoint,
std::function<void(std::tuple<const nsresult&, const uint8_t&>)>&&
@@ -93,11 +93,11 @@ void WebTransportParent::Create(
nsServerCertHashes = std::move(nsServerCertHashes),
principal = RefPtr{aPrincipal}, browsingContextID = aBrowsingContextID,
flags = nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL,
- clientInfo = ClientInfo{aClientInfo}] {
+ clientInfo = aClientInfo] {
LOG(("WebTransport %p AsyncConnect", self.get()));
if (NS_FAILED(self->mWebTransport->AsyncConnectWithClient(
uri, dedicated, std::move(nsServerCertHashes), principal,
- browsingContextID, flags, self, Some(clientInfo),
+ browsingContextID, flags, self, clientInfo,
nsIWebTransport::HTTPVersion::h3))) {
LOG(("AsyncConnect failure; we should get OnSessionClosed"));
}
diff --git a/dom/webtransport/parent/WebTransportParent.h b/dom/webtransport/parent/WebTransportParent.h
index 766026317dd..1215e99fbf5 100644
--- a/dom/webtransport/parent/WebTransportParent.h
+++ b/dom/webtransport/parent/WebTransportParent.h
@@ -33,8 +33,8 @@ class WebTransportParent : public PWebTransportParent,
void Create(const nsAString& aURL, nsIPrincipal* aPrincipal,
const uint64_t& aBrowsingContextID,
- const IPCClientInfo& aClientInfo, const bool& aDedicated,
- const bool& aRequireUnreliable,
+ const mozilla::Maybe<IPCClientInfo>& aClientInfo,
+ const bool& aDedicated, const bool& aRequireUnreliable,
const uint32_t& aCongestionControl,
nsTArray<WebTransportHash>&& aServerCertHashes,
Endpoint<PWebTransportParent>&& aParentEndpoint,
diff --git a/ipc/glue/BackgroundParentImpl.cpp b/ipc/glue/BackgroundParentImpl.cpp
index 65e6c92d41f..95dd1148a1a 100644
--- a/ipc/glue/BackgroundParentImpl.cpp
+++ b/ipc/glue/BackgroundParentImpl.cpp
@@ -463,9 +463,9 @@ mozilla::ipc::IPCResult BackgroundParentImpl::RecvCreateFileSystemManagerParent(
mozilla::ipc::IPCResult BackgroundParentImpl::RecvCreateWebTransportParent(
const nsAString& aURL, nsIPrincipal* aPrincipal,
- const uint64_t& aBrowsingContextID, const IPCClientInfo& aClientInfo,
- const bool& aDedicated, const bool& aRequireUnreliable,
- const uint32_t& aCongestionControl,
+ const uint64_t& aBrowsingContextID,
+ const mozilla::Maybe<IPCClientInfo>& aClientInfo, const bool& aDedicated,
+ const bool& aRequireUnreliable, const uint32_t& aCongestionControl,
nsTArray<WebTransportHash>&& aServerCertHashes,
Endpoint<PWebTransportParent>&& aParentEndpoint,
CreateWebTransportParentResolver&& aResolver) {
diff --git a/ipc/glue/BackgroundParentImpl.h b/ipc/glue/BackgroundParentImpl.h
index 8a6f056be76..429fd9b3f57 100644
--- a/ipc/glue/BackgroundParentImpl.h
+++ b/ipc/glue/BackgroundParentImpl.h
@@ -121,9 +121,9 @@ class BackgroundParentImpl : public PBackgroundParent {
mozilla::ipc::IPCResult RecvCreateWebTransportParent(
const nsAString& aURL, nsIPrincipal* aPrincipal,
- const uint64_t& aBrowsingContextID, const IPCClientInfo& aClientInfo,
- const bool& aDedicated, const bool& aRequireUnreliable,
- const uint32_t& aCongestionControl,
+ const uint64_t& aBrowsingContextID,
+ const mozilla::Maybe<IPCClientInfo>& aClientInfo, const bool& aDedicated,
+ const bool& aRequireUnreliable, const uint32_t& aCongestionControl,
nsTArray<WebTransportHash>&& aServerCertHashes,
Endpoint<PWebTransportParent>&& aParentEndpoint,
CreateWebTransportParentResolver&& aResolver) override;
diff --git a/ipc/glue/PBackground.ipdl b/ipc/glue/PBackground.ipdl
index bfc523c53e0..3575bc03208 100644
--- a/ipc/glue/PBackground.ipdl
+++ b/ipc/glue/PBackground.ipdl
@@ -178,7 +178,7 @@ parent:
nsString aURL,
nullable nsIPrincipal aPrincipal,
uint64_t aBrowsingContextID,
- IPCClientInfo aClientInfo,
+ IPCClientInfo? aClientInfo,
bool aDedicated,
bool aRequireUnreliable,
uint32_t aCongestionControl,
Loading diff…
References
On This Page