Medium firefox Sandbox Escape 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionSandbox escape due to incorrect boundary conditions in the WebRTC: Networking component
ComponentDOM
Bug ClassSandbox Escape
Tracker2029461
Fix commit1a97b77786bc (firefox) +203/-392
CISA KEVNot listed
CreditedThe Mozilla Fuzzing Team
Disclosed2026-04-21

Changed Functions

FunctionChangeNotes
if
dom/media/webrtc/transport/nricectx.cpp
modified
for
dom/media/webrtc/transport/nricectx.cpp
modified
for
dom/media/webrtc/transport/nricemediastream.cpp
modified
for
dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp
modified
if
dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp
modified

Files Changed

  • dom/media/webrtc/transport/nricectx.cpp
  • dom/media/webrtc/transport/nricemediastream.cpp
  • dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_component.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_ctx.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_media_stream.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_parser.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_peer_ctx.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_socket.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/net/nr_interface_prioritizer.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/net/nr_resolver.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/net/nr_socket.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/net/nr_socket_multi_tcp.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/addrs-win32.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/addrs.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/nr_socket_buffered_stun.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/nr_socket_turn.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_build.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_client_ctx.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_msg.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_proc.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/stun_server_ctx.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/stun/turn_client_ctx.cpp
  • dom/media/webrtc/transport/third_party/nICEr/src/util/ice_util.cpp
  • dom/media/webrtc/transport/third_party/nrappkit/nrappkit.gyp
  • dom/media/webrtc/transport/third_party/nrappkit/src/log/r_log.cpp
  • dom/media/webrtc/transport/third_party/nrappkit/src/registry/registry.cpp
  • dom/media/webrtc/transport/third_party/nrappkit/src/registry/registry.h
  • dom/media/webrtc/transport/third_party/nrappkit/src/registry/registry_local.cpp
  • dom/media/webrtc/transport/third_party/nrappkit/src/registry/registrycb.cpp
  • dom/media/webrtc/transport/third_party/nrappkit/src/util/libekr/r_assoc.cpp
  • dom/media/webrtc/transport/third_party/nrappkit/src/util/libekr/r_data.cpp
  • dom/media/webrtc/transport/third_party/nrappkit/src/util/libekr/r_list.cpp
  • dom/media/webrtc/transport/third_party/nrappkit/src/util/libekr/r_memory.cpp
  • dom/media/webrtc/transport/third_party/nrappkit/src/util/libekr/r_memory.h
  • dom/media/webrtc/transport/third_party/nrappkit/src/util/p_buf.cpp
diff --git a/dom/media/webrtc/transport/nricectx.cpp b/dom/media/webrtc/transport/nricectx.cpp
index 15530829be3..75f88113846 100644
--- a/dom/media/webrtc/transport/nricectx.cpp
+++ b/dom/media/webrtc/transport/nricectx.cpp
@@ -233,7 +233,7 @@ nsresult NrIceTurnServer::ToNicerTurnStruct(nr_ice_turn_server* server) const {
   nsresult rv = ToNicerStunStruct(&server->turn_server);
   if (NS_FAILED(rv)) return rv;
 
-  if (!(server->username = r_strdup(username_.c_str())))
+  if (!(server->username = strdup(username_.c_str())))
     return NS_ERROR_OUT_OF_MEMORY;
 
   // TODO([email protected]): handle non-ASCII passwords somehow?
@@ -246,7 +246,7 @@ nsresult NrIceTurnServer::ToNicerTurnStruct(nr_ice_turn_server* server) const {
   const UCHAR* data = password_.empty() ? nullptr : &password_[0];
   int r = r_data_create(&server->password, data, password_.size());
   if (r) {
-    RFREE(server->username);
+    free(server->username);
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
@@ -511,7 +511,7 @@ int NrIceCtx::candidate_error(void* obj, nr_ice_media_stream* stream,
   // processing the response. See bug 2018863.
   s->SignalCandidateError(s, address, port, url,
                           static_cast<uint16_t>(candidate->error_code), "");
-  RFREE(url);
+  free(url);
   return 0;
 }
 
@@ -1006,9 +1006,9 @@ std::vector<std::string> NrIceCtx::GetGlobalAttributes() {
 
   for (int i = 0; i < attrct; i++) {
     ret.push_back(std::string(attrs[i]));
-    RFREE(attrs[i]);
+    free(attrs[i]);
   }
-  RFREE(attrs);
+  free(attrs);
 
   return ret;
 }
@@ -1140,7 +1140,7 @@ void NrIceCtx::GenerateObfuscatedAddress(nr_ice_candidate* candidate,
 
       obfuscated_host_addresses_[*actual_address] = *mdns_address;
     }
-    candidate->mdns_addr = r_strdup(mdns_address->c_str());
+    candidate->mdns_addr = strdup(mdns_address->c_str());
   }
 }
 
diff --git a/dom/media/webrtc/transport/nricemediastream.cpp b/dom/media/webrtc/transport/nricemediastream.cpp
index 6e6327b3362..a9b73d3bb15 100644
--- a/dom/media/webrtc/transport/nricemediastream.cpp
+++ b/dom/media/webrtc/transport/nricemediastream.cpp
@@ -516,10 +516,10 @@ std::vector<std::string> NrIceMediaStream::GetAttributes() const {
 
   for (int i = 0; i < attrct; i++) {
     ret.push_back(attrs[i]);
-    RFREE(attrs[i]);
+    free(attrs[i]);
   }
 
-  RFREE(attrs);
+  free(attrs);
 
   return ret;
 }
diff --git a/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp b/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp
index 802af224249..a3e64200dba 100644
--- a/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp
+++ b/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp
@@ -143,9 +143,9 @@ class IcePeer {
 
     for (int i = 0; i < attrct; i++) {
       ret.push_back(std::string(attrs[i]));
-      RFREE(attrs[i]);
+      free(attrs[i]);
     }
-    RFREE(attrs);
+    free(attrs);
 
     return ret;
   }
@@ -166,9 +166,9 @@ class IcePeer {
 
     for (int i = 0; i < attrct; i++) {
       ret.push_back(std::string(attrs[i]));
-      RFREE(attrs[i]);
+      free(attrs[i]);
     }
-    RFREE(attrs);
+    free(attrs);
 
     return ret;
   }
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate.cpp
index ce2cf375e6c..402eb887f56 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate.cpp
@@ -175,7 +175,7 @@ int nr_ice_candidate_create(nr_ice_ctx *ctx,nr_ice_component *comp,nr_ice_socket
       }
     }
 
-    if(!(cand->label=r_strdup(label)))
+    if(!(cand->label=strdup(label)))
       ABORT(R_NO_MEMORY);
 
     if(r=nr_ice_get_foundation(ctx,cand))
@@ -223,7 +223,7 @@ int nr_ice_peer_peer_rflx_candidate_create(nr_ice_ctx *ctx, const char *label, n
 
     if(!(cand=R_NEW(nr_ice_candidate)))
       ABORT(R_NO_MEMORY);
-    if(!(cand->label=r_strdup(label)))
+    if(!(cand->label=strdup(label)))
       ABORT(R_NO_MEMORY);
 
     cand->state=NR_ICE_CAND_STATE_INITIALIZED;
@@ -242,7 +242,7 @@ int nr_ice_peer_peer_rflx_candidate_create(nr_ice_ctx *ctx, const char *label, n
     if(r=nr_transport_addr_copy(&cand->addr,addr))
       ABORT(r);
     /* Bogus foundation */
-    if(!(cand->foundation=r_strdup(cand->addr.as_string)))
+    if(!(cand->foundation=strdup(cand->addr.as_string)))
       ABORT(R_NO_MEMORY);
 
     nr_ice_candidate_compute_codeword(cand);
@@ -354,10 +354,10 @@ int nr_ice_candidate_destroy(nr_ice_candidate **candp)
         break;
     }
 
-    RFREE(cand->mdns_addr);
-    RFREE(cand->foundation);
-    RFREE(cand->label);
-    RFREE(cand);
+    free(cand->mdns_addr);
+    free(cand->foundation);
+    free(cand->label);
+    free(cand);
 
     return(0);
   }
@@ -404,7 +404,7 @@ static int nr_ice_get_foundation(nr_ice_ctx *ctx,nr_ice_candidate *cand)
       }
 
       snprintf(fnd,sizeof(fnd),"%d",i);
-      if(!(cand->foundation=r_strdup(fnd)))
+      if(!(cand->foundation=strdup(fnd)))
         ABORT(R_NO_MEMORY);
       return(0);
 
@@ -423,7 +423,7 @@ static int nr_ice_get_foundation(nr_ice_ctx *ctx,nr_ice_candidate *cand)
     STAILQ_INSERT_TAIL(&ctx->foundations,foundation,entry);
 
     snprintf(fnd,sizeof(fnd),"%d",i);
-    if(!(cand->foundation=r_strdup(fnd)))
+    if(!(cand->foundation=strdup(fnd)))
       ABORT(R_NO_MEMORY);
 
     _status=0;
@@ -997,7 +997,7 @@ static void nr_ice_turn_allocated_cb(NR_SOCKET s, int how, void *cb_arg)
 
         r_log(LOG_ICE,LOG_DEBUG,"ICE(%s)/CAND(%s): new relay base=%s addr=%s", cand->ctx->label, cand->label, cand->base.as_string, cand->addr.as_string);
 
-        RFREE(cand->label);
+        free(cand->label);
         cand->label=label;
         nr_ice_candidate_mark_done(cand, NR_ICE_CAND_STATE_INITIALIZED);
         cand = 0;
diff --git a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp
index 59f9f855a8b..a5878a71815 100644
--- a/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp
+++ b/dom/media/webrtc/transport/third_party/nICEr/src/ice/ice_candidate_pair.cpp
@@ -143,7 +143,7 @@ int nr_ice_candidate_pair_create(nr_ice_peer_ctx *pctx, nr_ice_candidate *lcand,
                                       &rcand->addr, RTO, flags,
                                       &pair->stun_client))
       ABORT(r);
-    if(!(pair->stun_client->params.ice_binding_request.username=r_strdup(rcand->stream->l2r_user)))
+    if(!(pair->stun_client->params.ice_binding_request.username=strdup(rcand->stream->l2r_user)))
       ABORT(R_NO_MEMORY);
     if(r=r_data_copy(&pair->stun_client->params.ice_binding_request.password,
       &rcand->stream->l2r_pass))
@@ -180,12 +180,12 @@ int nr_ice_candidate_pair_destroy(nr_ice_cand_pair **pairp)
       nr_accumulate_count(&(pair->local->ctx->stats.stun_retransmits), pair->stun_client->retransmit_ct);
     }
 
-    RFREE(pair->as_string);
-    RFREE(pair->foundation);
+    free(pair->as_string);
+    free(pair->foundation);
     nr_ice_socket_deregister(pair->local->isock,pair->stun_client_handle);
     if (pair->stun_client) {
-      RFREE(pair->stun_client->params.ice_binding_request.username);
-      RFREE(pair->stun_client->params.ice_binding_request.password.data);
+      free(pair->stun_client->params.ice_binding_request.username);
+      free(pair->stun_client->params.ice_binding_request.password.data);
       nr_stun_client_ctx_destroy(&pair->stun_client);
     }
 
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp b/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp
index 802af224249..a3e64200dba 100644
--- a/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp
+++ b/dom/media/webrtc/transport/test/test_nr_socket_ice_unittest.cpp
@@ -143,9 +143,9 @@ class IcePeer {
 
     for (int i = 0; i < attrct; i++) {
       ret.push_back(std::string(attrs[i]));
-      RFREE(attrs[i]);
+      free(attrs[i]);
     }
-    RFREE(attrs);
+    free(attrs);
 
     return ret;
   }
@@ -166,9 +166,9 @@ class IcePeer {
 
     for (int i = 0; i < attrct; i++) {
       ret.push_back(std::string(attrs[i]));
-      RFREE(attrs[i]);
+      free(attrs[i]);
     }
-    RFREE(attrs);
+    free(attrs);
 
     return ret;
   }
Loading diff…