Firefox · Widget
CVE-2026-92071
Logic Error in Widget
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
forwidget/windows/tests/gtest/TestWinUtils.cpp |
modified |
Files Changed
widget/windows/WinUtils.cppwidget/windows/WinUtils.hwidget/windows/moz.buildwidget/windows/tests/gtest/TestWinUtils.cpp
Patch
diff --git a/widget/windows/WinUtils.cpp b/widget/windows/WinUtils.cpp
index 7ce56b924e8..d2f26a5380a 100644
--- a/widget/windows/WinUtils.cpp
+++ b/widget/windows/WinUtils.cpp
@@ -5,6 +5,7 @@
#include "WinUtils.h"
#include <knownfolders.h>
+#include <pathcch.h>
#include <psapi.h>
#include <winioctl.h>
@@ -1709,8 +1710,9 @@ bool WinUtils::RunningFromANetworkDrive() {
/* static */
bool WinUtils::CanonicalizePath(nsAString& aPath) {
wchar_t tempPath[MAX_PATH + 1];
- if (!PathCanonicalizeW(tempPath,
- (char16ptr_t)PromiseFlatString(aPath).get())) {
+ HRESULT hr = PathCchCanonicalize(tempPath, std::size(tempPath),
+ (char16ptr_t)PromiseFlatString(aPath).get());
+ if (FAILED(hr)) {
return false;
}
aPath = tempPath;
diff --git a/widget/windows/WinUtils.h b/widget/windows/WinUtils.h
index 8e6f5e4ecad..3a3f1fe29e4 100644
--- a/widget/windows/WinUtils.h
+++ b/widget/windows/WinUtils.h
@@ -532,7 +532,7 @@ class WinUtils {
static nsresult WriteBitmap(nsIFile* aFile, imgIContainer* aImage);
/**
- * Wrapper for PathCanonicalize().
+ * Wrapper for PathCchCanonicalize().
* Upon success, the resulting output string length is <= MAX_PATH.
* @param aPath [in,out] The path to transform.
* @return true on success, false on failure.
diff --git a/widget/windows/moz.build b/widget/windows/moz.build
index 94aa860e44b..72d719b766d 100644
--- a/widget/windows/moz.build
+++ b/widget/windows/moz.build
@@ -211,6 +211,7 @@ USE_LIBS += [
OS_LIBS += [
"ktmw32",
+ "pathcch",
"rpcrt4",
"shcore",
"urlmon",
diff --git a/widget/windows/tests/gtest/TestWinUtils.cpp b/widget/windows/tests/gtest/TestWinUtils.cpp
index 830978d651e..e3af24c5025 100644
--- a/widget/windows/tests/gtest/TestWinUtils.cpp
+++ b/widget/windows/tests/gtest/TestWinUtils.cpp
@@ -302,3 +302,19 @@ TEST(WinUtils, TelemetryPathPrefix)
<< "input=" << NS_ConvertUTF16toUTF8(c.mInput).get();
}
}
+
+/*****************************************************************************/
+
+TEST(WinUtils, CanonicalizePathLength)
+{
+ nsAutoString shortPath(u"C:\\a\\.\\b");
+ EXPECT_TRUE(WinUtils::CanonicalizePath(shortPath));
+ EXPECT_STREQ(NS_ConvertUTF16toUTF8(shortPath).get(), "C:\\a\\b");
+
+ nsAutoString longPath(u"C:\\");
+ for (size_t i = 0; i < 5000; ++i) {
+ longPath.Append(u'A');
+ }
+ EXPECT_FALSE(WinUtils::CanonicalizePath(longPath));
+ EXPECT_EQ(longPath.Length(), 5003u);
+}
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/widget/windows/tests/gtest/TestWinUtils.cpp b/widget/windows/tests/gtest/TestWinUtils.cpp
index 830978d651e..e3af24c5025 100644
--- a/widget/windows/tests/gtest/TestWinUtils.cpp
+++ b/widget/windows/tests/gtest/TestWinUtils.cpp
@@ -302,3 +302,19 @@ TEST(WinUtils, TelemetryPathPrefix)
<< "input=" << NS_ConvertUTF16toUTF8(c.mInput).get();
}
}
+
+/*****************************************************************************/
+
+TEST(WinUtils, CanonicalizePathLength)
+{
+ nsAutoString shortPath(u"C:\\a\\.\\b");
+ EXPECT_TRUE(WinUtils::CanonicalizePath(shortPath));
+ EXPECT_STREQ(NS_ConvertUTF16toUTF8(shortPath).get(), "C:\\a\\b");
+
+ nsAutoString longPath(u"C:\\");
+ for (size_t i = 0; i < 5000; ++i) {
+ longPath.Append(u'A');
+ }
+ EXPECT_FALSE(WinUtils::CanonicalizePath(longPath));
+ EXPECT_EQ(longPath.Length(), 5003u);
+}
Loading diff…
References
On This Page