Medium firefox Sandbox Escape 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionSandbox escape due to incorrect boundary conditions in the WebRTC: Networking component
ComponentDOM
Bug ClassSandbox Escape
Tracker2029461
Fix commit1a97b77786bc (firefox) +203/-392
CISA KEVNot listed
CreditedThe Mozilla Fuzzing Team
Disclosed2026-04-21

Changed Functions

FunctionChangeNotes
if
dom/media/webrtc/transport/nricectx.cpp
modified
for
dom/media/webrtc/transport/nricectx.cpp
modified
for
dom/media/webrtc/transport/nricemediastream.cpp
modified
if
dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp
modified
if
dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_ctx.cpp
modified
for
dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_ctx.cpp
modified
while
dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_ctx.cpp
modified
STAILQ_FOREACH_SAFE
dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_ctx.cpp
modified

Files Changed

  • dom/media/webrtc/transport/nricectx.cpp
  • dom/media/webrtc/transport/nricemediastream.cpp
  • dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_component.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_ctx.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_media_stream.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_parser.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_peer_ctx.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_socket.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/net/nr_interface_prioritizer.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/net/nr_resolver.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/net/nr_socket.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/net/nr_socket_multi_tcp.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/addrs-win32.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/addrs.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/nr_socket_buffered_stun.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/nr_socket_turn.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_proc.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_server_ctx.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/turn_client_ctx.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/util/ice_util.cpp
  • dom/media/webrtc/transport/third_party/nrappkit/nrappkit.gyp
  • dom/media/webrtc/transport/third_party/nrappkit/src/log/r_log.cpp
  • dom/media/webrtc/transport/third_party/nrappkit/src/registry/registry.cpp
  • dom/media/webrtc/transport/third_party/nrappkit/src/registry/registry.h
  • dom/media/webrtc/transport/third_party/nrappkit/src/registry/registry_local.cpp
  • dom/media/webrtc/transport/third_party/nrappkit/src/registry/registrycb.cpp
  • dom/media/webrtc/transport/third_party/nrappkit/src/util/libekr/r_assoc.cpp
  • dom/media/webrtc/transport/third_party/nrappkit/src/util/libekr/r_data.cpp
  • dom/media/webrtc/transport/third_party/nrappkit/src/util/libekr/r_list.cpp
  • dom/media/webrtc/transport/third_party/nrappkit/src/util/libekr/r_memory.cpp
  • dom/media/webrtc/transport/third_party/nrappkit/src/util/libekr/r_memory.h
  • dom/media/webrtc/transport/third_party/nrappkit/src/util/p_buf.cpp
diff --git a/dom/media/webrtc/transport/nricectx.cpp b/dom/media/webrtc/transport/nricectx.cpp
index 15530829be3..75f88113846 100644
--- a/dom/media/webrtc/transport/nricectx.cpp
+++ b/dom/media/webrtc/transport/nricectx.cpp
@@ -233,7 +233,7 @@ nsresult NrIceTurnServer::ToNicerTurnStruct(nr_ice_turn_server* server) const {
   nsresult rv = ToNicerStunStruct(&server->turn_server);
   if (NS_FAILED(rv)) return rv;
 
-  if (!(server->username = r_strdup(username_.c_str())))
+  if (!(server->username = strdup(username_.c_str())))
     return NS_ERROR_OUT_OF_MEMORY;
 
   // TODO([email protected]): handle non-ASCII passwords somehow?
@@ -246,7 +246,7 @@ nsresult NrIceTurnServer::ToNicerTurnStruct(nr_ice_turn_server* server) const {
   const UCHAR* data = password_.empty() ? nullptr : &password_[0];
   int r = r_data_create(&server->password, data, password_.size());
   if (r) {
-    RFREE(server->username);
+    free(server->username);
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
@@ -511,7 +511,7 @@ int NrIceCtx::candidate_error(void* obj, nr_ice_media_stream* stream,
   // processing the response. See bug 2018863.
   s->SignalCandidateError(s, address, port, url,
                           static_cast<uint16_t>(candidate->error_code), "");
-  RFREE(url);
+  free(url);
   return 0;
 }
 
@@ -1006,9 +1006,9 @@ std::vector<std::string> NrIceCtx::GetGlobalAttributes() {
 
   for (int i = 0; i < attrct; i++) {
     ret.push_back(std::string(attrs[i]));
-    RFREE(attrs[i]);
+    free(attrs[i]);
   }
-  RFREE(attrs);
+  free(attrs);
 
   return ret;
 }
@@ -1140,7 +1140,7 @@ void NrIceCtx::GenerateObfuscatedAddress(nr_ice_candidate* candidate,
 
       obfuscated_host_addresses_[*actual_address] = *mdns_address;
     }
-    candidate->mdns_addr = r_strdup(mdns_address->c_str());
+    candidate->mdns_addr = strdup(mdns_address->c_str());
   }
 }
 
diff --git a/dom/media/webrtc/transport/nricemediastream.cpp b/dom/media/webrtc/transport/nricemediastream.cpp
index 6e6327b3362..a9b73d3bb15 100644
--- a/dom/media/webrtc/transport/nricemediastream.cpp
+++ b/dom/media/webrtc/transport/nricemediastream.cpp
@@ -516,10 +516,10 @@ std::vector<std::string> NrIceMediaStream::GetAttributes() const {
 
   for (int i = 0; i < attrct; i++) {
     ret.push_back(attrs[i]);
-    RFREE(attrs[i]);
+    free(attrs[i]);
   }
 
-  RFREE(attrs);
+  free(attrs);
 
   return ret;
 }
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate.cpp
index ce2cf375e6c..402eb887f56 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate.cpp
@@ -175,7 +175,7 @@ int nr_ice_candidate_create(nr_ice_ctx *ctx,nr_ice_component *comp,nr_ice_socket
       }
     }
 
-    if(!(cand->label=r_strdup(label)))
+    if(!(cand->label=strdup(label)))
       ABORT(R_NO_MEMORY);
 
     if(r=nr_ice_get_foundation(ctx,cand))
@@ -223,7 +223,7 @@ int nr_ice_peer_peer_rflx_candidate_create(nr_ice_ctx *ctx, const char *label, n
 
     if(!(cand=R_NEW(nr_ice_candidate)))
       ABORT(R_NO_MEMORY);
-    if(!(cand->label=r_strdup(label)))
+    if(!(cand->label=strdup(label)))
       ABORT(R_NO_MEMORY);
 
     cand->state=NR_ICE_CAND_STATE_INITIALIZED;
@@ -242,7 +242,7 @@ int nr_ice_peer_peer_rflx_candidate_create(nr_ice_ctx *ctx, const char *label, n
     if(r=nr_transport_addr_copy(&cand->addr,addr))
       ABORT(r);
     /* Bogus foundation */
-    if(!(cand->foundation=r_strdup(cand->addr.as_string)))
+    if(!(cand->foundation=strdup(cand->addr.as_string)))
       ABORT(R_NO_MEMORY);
 
     nr_ice_candidate_compute_codeword(cand);
@@ -354,10 +354,10 @@ int nr_ice_candidate_destroy(nr_ice_candidate **candp)
         break;
     }
 
-    RFREE(cand->mdns_addr);
-    RFREE(cand->foundation);
-    RFREE(cand->label);
-    RFREE(cand);
+    free(cand->mdns_addr);
+    free(cand->foundation);
+    free(cand->label);
+    free(cand);
 
     return(0);
   }
@@ -404,7 +404,7 @@ static int nr_ice_get_foundation(nr_ice_ctx *ctx,nr_ice_candidate *cand)
       }
 
       snprintf(fnd,sizeof(fnd),"%d",i);
-      if(!(cand->foundation=r_strdup(fnd)))
+      if(!(cand->foundation=strdup(fnd)))
         ABORT(R_NO_MEMORY);
       return(0);
 
@@ -423,7 +423,7 @@ static int nr_ice_get_foundation(nr_ice_ctx *ctx,nr_ice_candidate *cand)
     STAILQ_INSERT_TAIL(&ctx->foundations,foundation,entry);
 
     snprintf(fnd,sizeof(fnd),"%d",i);
-    if(!(cand->foundation=r_strdup(fnd)))
+    if(!(cand->foundation=strdup(fnd)))
       ABORT(R_NO_MEMORY);
 
     _status=0;
@@ -997,7 +997,7 @@ static void nr_ice_turn_allocated_cb(NR_SOCKET s, int how, void *cb_arg)
 
         r_log(LOG_ICE,LOG_DEBUG,"ICE(%s)/CAND(%s): new relay base=%s addr=%s", cand->ctx->label, cand->label, cand->base.as_string, cand->addr.as_string);
 
-        RFREE(cand->label);
+        free(cand->label);
         cand->label=label;
         nr_ice_candidate_mark_done(cand, NR_ICE_CAND_STATE_INITIALIZED);
         cand = 0;
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp
index 59f9f855a8b..a5878a71815 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp
@@ -143,7 +143,7 @@ int nr_ice_candidate_pair_create(nr_ice_peer_ctx *pctx, nr_ice_candidate *lcand,
                                       &rcand->addr, RTO, flags,
                                       &pair->stun_client))
       ABORT(r);
-    if(!(pair->stun_client->params.ice_binding_request.username=r_strdup(rcand->stream->l2r_user)))
+    if(!(pair->stun_client->params.ice_binding_request.username=strdup(rcand->stream->l2r_user)))
       ABORT(R_NO_MEMORY);
     if(r=r_data_copy(&pair->stun_client->params.ice_binding_request.password,
       &rcand->stream->l2r_pass))
@@ -180,12 +180,12 @@ int nr_ice_candidate_pair_destroy(nr_ice_cand_pair **pairp)
       nr_accumulate_count(&(pair->local->ctx->stats.stun_retransmits), pair->stun_client->retransmit_ct);
     }
 
-    RFREE(pair->as_string);
-    RFREE(pair->foundation);
+    free(pair->as_string);
+    free(pair->foundation);
     nr_ice_socket_deregister(pair->local->isock,pair->stun_client_handle);
     if (pair->stun_client) {
-      RFREE(pair->stun_client->params.ice_binding_request.username);
-      RFREE(pair->stun_client->params.ice_binding_request.password.data);
+      free(pair->stun_client->params.ice_binding_request.username);
+      free(pair->stun_client->params.ice_binding_request.password.data);
       nr_stun_client_ctx_destroy(&pair->stun_client);
     }
 
@@ -193,7 +193,7 @@ int nr_ice_candidate_pair_destroy(nr_ice_cand_pair **pairp)
     NR_async_timer_cancel(pair->restart_role_change_cb_timer);
     NR_async_timer_cancel(pair->restart_nominated_cb_timer);
 
-    RFREE(pair);
+    free(pair);
     return(0);
   }
 
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_component.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_component.cpp
index d13150ebe6e..814192d7b4c 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_component.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_component.cpp
@@ -74,7 +74,7 @@ static int nr_ice_pre_answer_request_create(nr_transport_addr *dst, nr_stun_serv
       ABORT(r);
     if (!nr_stun_message_has_attribute(par->req.request, NR_STUN_ATTR_USERNAME, &attr))
       ABORT(R_INTERNAL);
-    if (!(par->username = r_strdup(attr->u.username)))
+    if (!(par->username = strdup(attr->u.username)))
       ABORT(R_NO_MEMORY);
 
     *parp=par;
@@ -102,8 +102,8 @@ static int nr_ice_pre_answer_request_destroy(nr_ice_pre_answer_request **parp)
     nr_stun_message_destroy(&par->req.request);
     nr_stun_message_destroy(&par->req.response);
 
-    RFREE(par->username);
-    RFREE(par);
+    free(par->username);
+    free(par);
 
     return(0);
   }
@@ -173,7 +173,7 @@ int nr_ice_component_destroy(nr_ice_component **componentp)
       nr_ice_pre_answer_request_destroy(&r1);
     }
 
-    RFREE(component);
+    free(component);
     return(0);
   }
 
@@ -1698,7 +1698,7 @@ int nr_ice_component_select_pair(nr_ice_peer_ctx *pctx, nr_ice_component *comp)
 
     _status=0;
   abort:
-    RFREE(pairs);
+    free(pairs);
     return(_status);
   }
 
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_ctx.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_ctx.cpp
index d574a923533..98464bdc42d 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_ctx.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_ctx.cpp
@@ -104,7 +104,7 @@ int nr_ice_fetch_stun_servers(int ct, nr_ice_stun_server **out)
       if (r = nr_ip4_port_to_transport_addr(ntohl(addr_int), port, IPPROTO_UDP,
                                             &servers[i].addr))
         ABORT(r);
-      RFREE(addr);
+      free(addr);
       addr=0;
     }
 
@@ -112,8 +112,8 @@ int nr_ice_fetch_stun_servers(int ct, nr_ice_stun_server **out)
 
     _status=0;
   abort:
-    RFREE(addr);
-    if (_status) RFREE(servers);
+    free(addr);
+    if (_status) free(servers);
     return(_status);
   }
 
@@ -122,7 +122,7 @@ int nr_ice_ctx_set_stun_servers(nr_ice_ctx *ctx,nr_ice_stun_server *servers,int
     int _status;
 
     if(ctx->stun_servers_cfg){
-      RFREE(ctx->stun_servers_cfg);
+      free(ctx->stun_servers_cfg);
       ctx->stun_servers_cfg=NULL;
       ctx->stun_server_ct_cfg=0;
     }
@@ -146,10 +146,10 @@ int nr_ice_ctx_set_turn_servers(nr_ice_ctx *ctx,nr_ice_turn_server *servers,int
 
     if(ctx->turn_servers_cfg){
       for (int i = 0; i < ctx->turn_server_ct_cfg; i++) {
-        RFREE(ctx->turn_servers_cfg[i].username);
+        free(ctx->turn_servers_cfg[i].username);
         r_data_destroy(&ctx->turn_servers_cfg[i].password);
       }
-      RFREE(ctx->turn_servers_cfg);
+      free(ctx->turn_servers_cfg);
       ctx->turn_servers_cfg=NULL;
       ctx->turn_server_ct_cfg=0;
     }
@@ -172,7 +172,7 @@ static int nr_ice_ctx_set_local_addrs(nr_ice_ctx *ctx,nr_local_addr *addrs,int c
     int _status,i,r;
 
     if(ctx->local_addrs) {
-      RFREE(ctx->local_addrs);
+      free(ctx->local_addrs);
       ctx->local_addr_ct=0;
       ctx->local_addrs=0;
     }
@@ -284,7 +284,7 @@ int nr_ice_fetch_turn_servers(int ct, nr_ice_turn_server **out)
         data.data=0;
       }
 
-      RFREE(addr);
+      free(addr);
       addr=0;
     }
 
@@ -292,9 +292,9 @@ int nr_ice_fetch_turn_servers(int ct, nr_ice_turn_server **out)
 
     _status=0;
   abort:
-    RFREE(data.data);
-    RFREE(addr);
-    if (_status) RFREE(servers);
+    free(data.data);
+    free(addr);
+    if (_status) free(servers);
     return(_status);
   }
 #endif /* USE_TURN */
@@ -314,7 +314,7 @@ int nr_ice_fetch_turn_servers(int ct, nr_ice_turn_server **out)
 
     ctx->flags=flags;
 
-    if(!(ctx->label=r_strdup(label)))
+    if(!(ctx->label=strdup(label)))
       ABORT(R_NO_MEMORY);
 
     ctx->gather_handler = gather_handler;
@@ -428,39 +428,39 @@ int nr_ice_fetch_turn_servers(int ct, nr_ice_turn_server **out)
       nr_ice_media_stream_destroy(&s1);
     }
 
-    RFREE(ctx->label);
+    free(ctx->label);
 
     ctx->gather_handler = 0;
 
-    RFREE(ctx->stun_servers_cfg);
+    free(ctx->stun_servers_cfg);
 
-    RFREE(ctx->local_addrs);
+    free(ctx->local_addrs);
 
-    RFREE(ctx->target_for_default_local_address_lookup);
+    free(ctx->target_for_default_local_address_lookup);
 
     for (i = 0; i < ctx->turn_server_ct_cfg; i++) {
-        RFREE(ctx->turn_servers_cfg[i].username);
+        free(ctx->turn_servers_cfg[i].username);
         r_data_destroy(&ctx->turn_servers_cfg[i].password);
     }
-    RFREE(ctx->turn_servers_cfg);
+    free(ctx->turn_servers_cfg);
 
     f1=STAILQ_FIRST(&ctx->foundations);
     while(f1){
       f2=STAILQ_NEXT(f1,entry);
-      RFREE(f1);
+      free(f1);
       f1=f2;
     }
 
     STAILQ_FOREACH_SAFE(id1, &ctx->ids, entry, id2){
       STAILQ_REMOVE(&ctx->ids,id1,nr_ice_stun_id_,entry);
-      RFREE(id1);
+      free(id1);
     }
 
     nr_resolver_destroy(&ctx->resolver);
     nr_interface_prioritizer_destroy(&ctx->interface_prioritizer);
     nr_socket_factory_destroy(&ctx->socket_factory);
 
-    RFREE(ctx);
+    free(ctx);
 
     *ctxp=0;
   }
@@ -820,7 +820,7 @@ int nr_ice_set_target_for_default_local_address_lookup(nr_ice_ctx *ctx, const ch
     int r,_status;
 
     if (ctx->target_for_default_local_address_lookup) {
-      RFREE(ctx->target_for_default_local_address_lookup);
+      free(ctx->target_for_default_local_address_lookup);
       ctx->target_for_default_local_address_lookup=0;
     }
 
@@ -828,7 +828,7 @@ int nr_ice_set_target_for_default_local_address_lookup(nr_ice_ctx *ctx, const ch
       ABORT(R_NO_MEMORY);
 
     if ((r=nr_str_port_to_transport_addr(target_ip, target_port, IPPROTO_UDP, ctx->target_for_default_local_address_lookup))) {
-      RFREE(ctx->target_for_default_local_address_lookup);
+      free(ctx->target_for_default_local_address_lookup);
       ctx->target_for_default_local_address_lookup=0;
       ABORT(r);
     }
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_media_stream.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_media_stream.cpp
index 5fa4cb60267..c3840bc2c6f 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_media_stream.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_media_stream.cpp
@@ -54,13 +54,13 @@ int nr_ice_media_stream_create(nr_ice_ctx *ctx,const char *label,const char *ufr
     if(!(stream=R_NEW(nr_ice_media_stream)))
       ABORT(R_NO_MEMORY);
 
-    if(!(stream->label=r_strdup(label)))
+    if(!(stream->label=strdup(label)))
       ABORT(R_NO_MEMORY);
 
-    if(!(stream->ufrag=r_strdup(ufrag)))
+    if(!(stream->ufrag=strdup(ufrag)))
       ABORT(R_NO_MEMORY);
 
-    if(!(stream->pwd=r_strdup(pwd)))
+    if(!(stream->pwd=strdup(pwd)))
       ABORT(R_NO_MEMORY);
 
     stream->ctx=ctx;
@@ -100,7 +100,7 @@ int nr_ice_media_stream_create(nr_ice_ctx *ctx,const char *label,const char *ufr
         nr_ice_turn_server *dst = &stream->turn_servers[i];
         nr_ice_turn_server *src = &ctx->turn_servers_cfg[i];
... (file diff truncated)
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp b/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp
index 802af224249..a3e64200dba 100644
--- a/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp
+++ b/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp
@@ -143,9 +143,9 @@ class IcePeer {
 
     for (int i = 0; i < attrct; i++) {
       ret.push_back(std::string(attrs[i]));
-      RFREE(attrs[i]);
+      free(attrs[i]);
     }
-    RFREE(attrs);
+    free(attrs);
 
     return ret;
   }
@@ -166,9 +166,9 @@ class IcePeer {
 
     for (int i = 0; i < attrct; i++) {
       ret.push_back(std::string(attrs[i]));
-      RFREE(attrs[i]);
+      free(attrs[i]);
     }
-    RFREE(attrs);
+    free(attrs);
 
     return ret;
   }
Loading diff…