Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionSandbox escape due to incorrect boundary conditions in the Widget: Win32 component
ComponentWidget
Bug ClassLogic Error
Tracker2061231
Fix commit4233e7b2be32 (firefox) +22/-3
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-15

Changed Functions

FunctionChangeNotes
for
widget/windows/tests/gtest/TestWinUtils.cpp
modified

Files Changed

  • widget/windows/WinUtils.cpp
  • widget/windows/WinUtils.h
  • widget/windows/moz.build
  • widget/windows/tests/gtest/TestWinUtils.cpp
diff --git a/widget/windows/WinUtils.cpp b/widget/windows/WinUtils.cpp
index 7ce56b924e8..d2f26a5380a 100644
--- a/widget/windows/WinUtils.cpp
+++ b/widget/windows/WinUtils.cpp
@@ -5,6 +5,7 @@
 #include "WinUtils.h"
 
 #include <knownfolders.h>
+#include <pathcch.h>
 #include <psapi.h>
 #include <winioctl.h>
 
@@ -1709,8 +1710,9 @@ bool WinUtils::RunningFromANetworkDrive() {
 /* static */
 bool WinUtils::CanonicalizePath(nsAString& aPath) {
   wchar_t tempPath[MAX_PATH + 1];
-  if (!PathCanonicalizeW(tempPath,
-                         (char16ptr_t)PromiseFlatString(aPath).get())) {
+  HRESULT hr = PathCchCanonicalize(tempPath, std::size(tempPath),
+                                   (char16ptr_t)PromiseFlatString(aPath).get());
+  if (FAILED(hr)) {
     return false;
   }
   aPath = tempPath;
diff --git a/widget/windows/WinUtils.h b/widget/windows/WinUtils.h
index 8e6f5e4ecad..3a3f1fe29e4 100644
--- a/widget/windows/WinUtils.h
+++ b/widget/windows/WinUtils.h
@@ -532,7 +532,7 @@ class WinUtils {
   static nsresult WriteBitmap(nsIFile* aFile, imgIContainer* aImage);
 
   /**
-   * Wrapper for PathCanonicalize().
+   * Wrapper for PathCchCanonicalize().
    * Upon success, the resulting output string length is <= MAX_PATH.
    * @param  aPath [in,out] The path to transform.
    * @return true on success, false on failure.
diff --git a/widget/windows/moz.build b/widget/windows/moz.build
index 94aa860e44b..72d719b766d 100644
--- a/widget/windows/moz.build
+++ b/widget/windows/moz.build
@@ -211,6 +211,7 @@ USE_LIBS += [
 
 OS_LIBS += [
     "ktmw32",
+    "pathcch",
     "rpcrt4",
     "shcore",
     "urlmon",
diff --git a/widget/windows/tests/gtest/TestWinUtils.cpp b/widget/windows/tests/gtest/TestWinUtils.cpp
index 830978d651e..e3af24c5025 100644
--- a/widget/windows/tests/gtest/TestWinUtils.cpp
+++ b/widget/windows/tests/gtest/TestWinUtils.cpp
@@ -302,3 +302,19 @@ TEST(WinUtils, TelemetryPathPrefix)
         << "input=" << NS_ConvertUTF16toUTF8(c.mInput).get();
   }
 }
+
+/*****************************************************************************/
+
+TEST(WinUtils, CanonicalizePathLength)
+{
+  nsAutoString shortPath(u"C:\\a\\.\\b");
+  EXPECT_TRUE(WinUtils::CanonicalizePath(shortPath));
+  EXPECT_STREQ(NS_ConvertUTF16toUTF8(shortPath).get(), "C:\\a\\b");
+
+  nsAutoString longPath(u"C:\\");
+  for (size_t i = 0; i < 5000; ++i) {
+    longPath.Append(u'A');
+  }
+  EXPECT_FALSE(WinUtils::CanonicalizePath(longPath));
+  EXPECT_EQ(longPath.Length(), 5003u);
+}
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/widget/windows/tests/gtest/TestWinUtils.cpp b/widget/windows/tests/gtest/TestWinUtils.cpp
index 830978d651e..e3af24c5025 100644
--- a/widget/windows/tests/gtest/TestWinUtils.cpp
+++ b/widget/windows/tests/gtest/TestWinUtils.cpp
@@ -302,3 +302,19 @@ TEST(WinUtils, TelemetryPathPrefix)
         << "input=" << NS_ConvertUTF16toUTF8(c.mInput).get();
   }
 }
+
+/*****************************************************************************/
+
+TEST(WinUtils, CanonicalizePathLength)
+{
+  nsAutoString shortPath(u"C:\\a\\.\\b");
+  EXPECT_TRUE(WinUtils::CanonicalizePath(shortPath));
+  EXPECT_STREQ(NS_ConvertUTF16toUTF8(shortPath).get(), "C:\\a\\b");
+
+  nsAutoString longPath(u"C:\\");
+  for (size_t i = 0; i < 5000; ++i) {
+    longPath.Append(u'A');
+  }
+  EXPECT_FALSE(WinUtils::CanonicalizePath(longPath));
+  EXPECT_EQ(longPath.Length(), 5003u);
+}
Loading diff…