Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionIncorrect boundary conditions in the WebRTC: Networking component
ComponentDOM
Bug ClassLogic Error
Tracker2021770
Fix commit1cc314d86501 (firefox) +4/-1
CISA KEVNot listed
CreditedNan Wang
Disclosed2026-04-21

Changed Functions

FunctionChangeNotes
if
dom/media/webrtc/transport/third_party/nICEr/src/net/transport_addr.cpp
modified

Files Changed

  • dom/media/webrtc/transport/nr_socket_prsock.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/net/transport_addr.cpp
diff --git a/dom/media/webrtc/transport/nr_socket_prsock.cpp b/dom/media/webrtc/transport/nr_socket_prsock.cpp
index 5e9a9d03366..fd0eeee8170 100644
--- a/dom/media/webrtc/transport/nr_socket_prsock.cpp
+++ b/dom/media/webrtc/transport/nr_socket_prsock.cpp
@@ -528,7 +528,7 @@ abort:
 int nr_transport_addr_get_addrstring_and_port(const nr_transport_addr* addr,
                                               nsACString* host, int32_t* port) {
   int r, _status;
-  char addr_string[64];
+  char addr_string[256];
 
   // We cannot directly use |nr_transport_addr.as_string| because it contains
   // more than ip address, therefore, we need to explicity convert it
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/net/transport_addr.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/net/transport_addr.cpp
index efedb3782aa..265c38f36c9 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/net/transport_addr.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/net/transport_addr.cpp
@@ -281,6 +281,9 @@ int nr_transport_addr_get_addrstring(const nr_transport_addr *addr, char *str, i
     int _status;
 
     if (addr->fqdn[0]) {
+      if (maxlen <= strlen(addr->fqdn)) {
+        ABORT(R_BAD_ARGS);
+      }
       strncpy(str, addr->fqdn, maxlen);
     } else {
       const char* res;
Loading diff…