github/electron
1
1
Fork 0
mirror of https://github.com/electron/electron.git synced 2026-04-10 03:01:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

chore: cherry-pick 406ae3e8a9a8 from chromium (#28813)

Browse Source 
* chore: cherry-pick 406ae3e8a9a8 from chromium

* update patches

Co-authored-by: Electron Bot <electron@github.com>
Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>
Co-authored-by: Samuel Attard <sam@electronjs.org>
This commit is contained in:
Pedro Pontes
2021-04-28 09:45:40 +02:00
committed by GitHub
parent 7ea754dbed
commit a03607cacc
2 changed files with 101 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
patches/chromium/.patches
View File

@@ -155,3 +155,4 @@ cherry-pick-fe85e04a1797.patch
cherry-pick-6b84dc72351b.patch
cherry-pick-1028ffc9bd83.patch
privacy_budget_remove_unnecessary_kcanvasreadback_metrics.patch
cherry-pick-406ae3e8a9a8.patch

100
patches/chromium/cherry-pick-406ae3e8a9a8.patch Normal file
View File

@@ -0,0 +1,100 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Ken Rockot <rockot@google.com>
Date: Tue, 20 Apr 2021 15:46:33 +0000
Subject: M86-LTS: Mojo: Properly validate broadcast events
This corrects broadcast event deserialization by adding a missing
validation step when decoding the outer message header.
(cherry picked from commit 6740adb28374ddeee13febfd5e5d20cb8a365979)
Fixed: 1195308
Change-Id: Ia67a20e48614e7ef00b1b32f7f4e5f20235be310
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2808678
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Commit-Queue: Ken Rockot <rockot@google.com>
Cr-Original-Commit-Position: refs/heads/master@{#870238}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2837712
Owners-Override: Achuith Bhandarkar <achuith@chromium.org>
Auto-Submit: Achuith Bhandarkar <achuith@chromium.org>
Reviewed-by: Artem Sumaneev <asumaneev@google.com>
Commit-Queue: Achuith Bhandarkar <achuith@chromium.org>
Cr-Commit-Position: refs/branch-heads/4240@{#1614}
Cr-Branched-From: f297677702651916bbf65e59c0d4bbd4ce57d1ee-refs/heads/master@{#800218}
diff --git a/mojo/core/node_channel.cc b/mojo/core/node_channel.cc
index 5db339ec802497dd46364bba2425aae0af2f9615..901c0f76c638ac01e1b9e2b0d4fa19c8424a2ce0 100644
--- a/mojo/core/node_channel.cc
+++ b/mojo/core/node_channel.cc
@@ -191,13 +191,16 @@ Channel::MessagePtr NodeChannel::CreateEventMessage(size_t capacity,
}
// static
-void NodeChannel::GetEventMessageData(Channel::Message* message,
+bool NodeChannel::GetEventMessageData(Channel::Message& message,
void** data,
size_t* num_data_bytes) {
- // NOTE: OnChannelMessage guarantees that we never accept a Channel::Message
- // with a payload of fewer than |sizeof(Header)| bytes.
- *data = reinterpret_cast<Header*>(message->mutable_payload()) + 1;
- *num_data_bytes = message->payload_size() - sizeof(Header);
+ // NOTE: Callers must guarantee that the payload in `message` must be at least
+ // large enough to hold a Header.
+ if (message.payload_size() < sizeof(Header))
+ return false;
+ *data = reinterpret_cast<Header*>(message.mutable_payload()) + 1;
+ *num_data_bytes = message.payload_size() - sizeof(Header);
+ return true;
}
void NodeChannel::Start() {
diff --git a/mojo/core/node_channel.h b/mojo/core/node_channel.h
index 58ab42bd01fc856856d171985dac50934d4e00b2..7ae08e3e73110667f0eafe0fe4f70242bfeece39 100644
--- a/mojo/core/node_channel.h
+++ b/mojo/core/node_channel.h
@@ -90,7 +90,9 @@ class MOJO_SYSTEM_IMPL_EXPORT NodeChannel
void** payload,
size_t num_handles);
- static void GetEventMessageData(Channel::Message* message,
+ // Retrieves address and size of an Event message's underlying message data.
+ // Returns `false` if the message is not a valid Event message.
+ static bool GetEventMessageData(Channel::Message& message,
void** data,
size_t* num_data_bytes);
diff --git a/mojo/core/node_controller.cc b/mojo/core/node_controller.cc
index a297c500215a58aa5b86157e765a64671ca91188..38ebaea2d988c241982824dfae62cccc7c5e28eb 100644
--- a/mojo/core/node_controller.cc
+++ b/mojo/core/node_controller.cc
@@ -76,7 +76,9 @@ ports::ScopedEvent DeserializeEventMessage(
Channel::MessagePtr channel_message) {
void* data;
size_t size;
- NodeChannel::GetEventMessageData(channel_message.get(), &data, &size);
+ bool valid = NodeChannel::GetEventMessageData(*channel_message, &data, &size);
+ if (!valid)
+ return nullptr;
auto event = ports::Event::Deserialize(data, size);
if (!event)
return nullptr;
diff --git a/mojo/core/user_message_impl.cc b/mojo/core/user_message_impl.cc
index bd3a6766e9dfd1c405209dfb2bdf348ba568af26..e40682b0718b5e1dd9063d2418e82fabc7b322aa 100644
--- a/mojo/core/user_message_impl.cc
+++ b/mojo/core/user_message_impl.cc
@@ -417,7 +417,14 @@ Channel::MessagePtr UserMessageImpl::FinalizeEventMessage(
if (channel_message) {
void* data;
size_t size;
- NodeChannel::GetEventMessageData(channel_message.get(), &data, &size);
+ // The `channel_message` must either be produced locally or must have
+ // already been validated by the caller, as is done for example by
+ // NodeController::DeserializeEventMessage before
+ // NodeController::OnBroadcast re-serializes each copy of the message it
+ // received.
+ bool result =
+ NodeChannel::GetEventMessageData(*channel_message, &data, &size);
+ DCHECK(result);
message_event->Serialize(data);
}