Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionIncorrect boundary conditions in the Networking: JAR component
ComponentCore
Bug ClassLogic Error
Tracker1164141
Fix commit88e5a9581e79 (firefox) +17/-21
CISA KEVNot listed
CreditedAlex Mayorga
Disclosed2026-02-24

Changed Functions

FunctionChangeNotes
if
mozglue/misc/MmapFaultHandler.h
modified

Files Changed

  • mozglue/misc/MmapFaultHandler.cpp
  • mozglue/misc/MmapFaultHandler.h
diff --git a/mozglue/misc/MmapFaultHandler.cpp b/mozglue/misc/MmapFaultHandler.cpp
index a73b9bd24b7..747491bc887 100644
--- a/mozglue/misc/MmapFaultHandler.cpp
+++ b/mozglue/misc/MmapFaultHandler.cpp
@@ -24,10 +24,6 @@ static void MmapSIGBUSHandler(int signum, siginfo_t* info, void* context) {
   MmapAccessScope* mas = sMmapAccessScope.get();
 
   if (mas && mas->IsInsideBuffer(info->si_addr)) {
-    // Temporarily instead of handling the signal, we crash intentionally and
-    // send some diagnostic information to find out why the signal is received.
-    mas->CrashWithInfo(info->si_addr);
-
     // The address is inside the buffer, handle the failure.
     siglongjmp(mas->mJmpBuf, signum);
   }
diff --git a/mozglue/misc/MmapFaultHandler.h b/mozglue/misc/MmapFaultHandler.h
index fca356921c7..485b74385aa 100644
--- a/mozglue/misc/MmapFaultHandler.h
+++ b/mozglue/misc/MmapFaultHandler.h
@@ -78,23 +78,23 @@ inline bool ValidFD(T fd) {
   return !!fd;
 }
 
-#  define MMAP_FAULT_HANDLER_BEGIN_HANDLE(fd)                  \
-    {                                                          \
-      void* mmapScopeBuf = nullptr;                            \
-      nsCString mmapScopeFilename;                             \
-      uint32_t mmapScopeBufLen = 0;                            \
-      if (ValidFD(fd) && fd->mMap) {                           \
-        mmapScopeBuf = (void*)fd->mFileStart;                  \
-        mmapScopeBufLen = fd->mTotalLen;                       \
-      }                                                        \
-      if (ValidFD(fd) && fd->mFile) {                          \
-        nsCOMPtr<nsIFile> file = fd->mFile.GetBaseFile();      \
-        if (file) {                                            \
-          file->GetNativeLeafName(mmapScopeFilename);          \
-        }                                                      \
-      }                                                        \
-      MmapAccessScope mmapScope(mmapScopeBuf, mmapScopeBufLen, \
-                                mmapScopeFilename.get());      \
+#  define MMAP_FAULT_HANDLER_BEGIN_HANDLE(fd)                   \
+    {                                                           \
+      void* mmapScopeBuf = nullptr;                             \
+      nsCString mmapScopeFilename;                              \
+      uint32_t mmapScopeBufLen = 0;                             \
+      if (ValidFD(fd) && fd->mFileStart && fd->mTotalLen > 0) { \
+        mmapScopeBuf = (void*)fd->mFileStart;                   \
+        mmapScopeBufLen = fd->mTotalLen;                        \
+      }                                                         \
+      if (ValidFD(fd) && fd->mFile) {                           \
+        nsCOMPtr<nsIFile> file = fd->mFile.GetBaseFile();       \
+        if (file) {                                             \
+          file->GetNativeLeafName(mmapScopeFilename);           \
+        }                                                       \
+      }                                                         \
+      MmapAccessScope mmapScope(mmapScopeBuf, mmapScopeBufLen,  \
+                                mmapScopeFilename.get());       \
       if (sigsetjmp(mmapScope.mJmpBuf, 0) == 0) {
 #  define MMAP_FAULT_HANDLER_BEGIN_BUFFER(buf, bufLen)   \
     {                                                    \
Loading diff…