From e29aad050d446feabdb5a7a2aa9fdc6dfef243da Mon Sep 17 00:00:00 2001
From: Harveer Singh <hsingh@mozilla.com>
Date: Tue, 16 Jun 2026 15:22:41 +0000
Subject: [PATCH] Bug 2025417: Capping a max size on SharedMap value that could
 be stored/broadcasted.r=ipc-reviewers,mccr8

Differential Revision: https://phabricator.services.mozilla.com/D301581
---
 dom/ipc/SharedMap.cpp | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/dom/ipc/SharedMap.cpp b/dom/ipc/SharedMap.cpp
index a92e2d45117a..de3d2ef2426b 100644
--- a/dom/ipc/SharedMap.cpp
+++ b/dom/ipc/SharedMap.cpp
@@ -7,6 +7,7 @@
 #include "MemMapSnapshot.h"
 #include "ScriptPreloader-inl.h"
 #include "SharedMapChangeEvent.h"
+#include "mozilla/CheckedInt.h"
 #include "mozilla/IOBuffers.h"
 #include "mozilla/RefPtr.h"
 #include "mozilla/ScriptPreloader.h"
@@ -157,9 +158,13 @@ bool SharedMap::GetValueAtIndex(JSContext* aCx, uint32_t aIndex,
 void SharedMap::Entry::SetData(StructuredCloneData* aHolder) {
   MOZ_ASSERT(!aHolder->SupportsTransferring());
 
+  CheckedInt<uint32_t> size = aHolder->BufferData().Size();
+  MOZ_RELEASE_ASSERT(size.isValid(),
+                     "SharedMap entry size exceeds max allowed size");
+
   mData = AsVariant(RefPtr{aHolder});
 
-  mSize = Holder()->BufferData().Size();
+  mSize = size.value();
   mBlobCount = Holder()->BlobImpls().Length();
 }
 
@@ -392,6 +397,12 @@ void WritableSharedMap::Set(JSContext* aCx, const nsACString& aName,
     return;
   }
 
+  // Cap the maximum size of a value that can be stored inside SharedMap.
+  if (!CheckedInt<uint32_t>(holder->BufferData().Size()).isValid()) {
+    aRv.ThrowRangeError("SharedMap value too large");
+    return;
+  }
+
   if (!holder->InputStreams().IsEmpty()) {
     aRv.Throw(NS_ERROR_INVALID_ARG);
     return;