From 6d854212061356fe50a48c6a63ff29a2c23225d2 Mon Sep 17 00:00:00 2001
From: Lars Eggert <lars@eggert.org>
Date: Fri, 25 Sep 2026 11:51:28 +0300
Subject: [PATCH] Bug 1718838 - Don't call pthread_equal() on possibly-invalid
 thread IDs

PR_GetMonitorEntryCount() could pass an unset mon->owner to pthread_equal(), which is UB. Only compare when entryCount != 0.

https://bugzilla.mozilla.org/show_bug.cgi?id=1718838

From NetBSD pkgsrc.
---
 pr/src/pthreads/ptsynch.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pr/src/pthreads/ptsynch.c b/pr/src/pthreads/ptsynch.c
index 3ca6dfff..237a0d6f 100644
--- a/pr/src/pthreads/ptsynch.c
+++ b/pr/src/pthreads/ptsynch.c
@@ -575,7 +575,7 @@ PR_GetMonitorEntryCount(PRMonitor* mon)
 
     rv = pthread_mutex_lock(&mon->lock);
     PR_ASSERT(0 == rv);
-    if (pthread_equal(mon->owner, self)) {
+    if (mon->entryCount != 0 && pthread_equal(mon->owner, self)) {
         count = mon->entryCount;
     }
     rv = pthread_mutex_unlock(&mon->lock);