github/electron
1
1
Fork 0
mirror of https://github.com/electron/electron.git synced 2026-04-10 03:01:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

chore: cherry-pick 51daffbf5cd8 from chromium (#35547)

Browse Source 
* chore: [18-x-y] cherry-pick 51daffbf5cd8 from chromium

* chore: update patches

Co-authored-by: PatchUp <73610968+patchup[bot]@users.noreply.github.com>
Co-authored-by: Electron Bot <electron@github.com>
This commit is contained in:
Pedro Pontes
2022-09-07 16:24:30 +02:00
committed by GitHub
parent 44926055ae
commit b8f0882c6c
2 changed files with 46 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
patches/chromium/.patches
View File

@@ -152,4 +152,5 @@ cherry-pick-54e32332750c.patch
cherry-pick-2f19801aeb77.patch
cherry-pick-96306321286a.patch
feat_add_set_can_resize_mutator.patch
cherry-pick-51daffbf5cd8.patch
cherry-pick-079105b7ebba.patch

45
patches/chromium/cherry-pick-51daffbf5cd8.patch Normal file
View File

@@ -0,0 +1,45 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Yutaka Hirano <yhirano@chromium.org>
Date: Mon, 4 Jul 2022 11:48:20 +0000
Subject: Fix UAF on network::URLLoader
network::URLLoader::SetUpUpload calls NotifyCompleted asynchronously,
as it can be called in the constructor and we don't want to run
NotifyCompleted in the constructor.
The problem is that it attaches a raw pointer to the method, which leads to a use-after-free problem if the URLLoader is destructed before
NotifyCompleted is called.
Use weak pointers instead of raw pointers to avoid the problem.
Bug: 1340253
Change-Id: Iacb1e772bf7a8e3de4a7bb9de342fea9ba0f3f3c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3740150
Reviewed-by: Kenichi Ishibashi <bashi@chromium.org>
Commit-Queue: Yutaka Hirano <yhirano@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1020539}
diff --git a/services/network/url_loader.cc b/services/network/url_loader.cc
index e08bb784a11209f1531e8d981bd238d67db31e22..318bee62609cbb46741ec06eb373aaf5ed5b63d9 100644
--- a/services/network/url_loader.cc
+++ b/services/network/url_loader.cc
@@ -786,8 +786,8 @@ void URLLoader::OpenFilesForUpload(const ResourceRequest& request) {
// initializing before getting deleted.
base::SequencedTaskRunnerHandle::Get()->PostTask(
FROM_HERE,
- base::BindOnce(&URLLoader::NotifyCompleted, base::Unretained(this),
- net::ERR_ACCESS_DENIED));
+ base::BindOnce(&URLLoader::NotifyCompleted,
+ weak_ptr_factory_.GetWeakPtr(), net::ERR_ACCESS_DENIED));
return;
}
url_request_->LogBlockedBy("Opening Files");
@@ -806,7 +806,7 @@ void URLLoader::SetUpUpload(const ResourceRequest& request,
// initializing before getting deleted.
base::SequencedTaskRunnerHandle::Get()->PostTask(
FROM_HERE, base::BindOnce(&URLLoader::NotifyCompleted,
- base::Unretained(this), error_code));
+ weak_ptr_factory_.GetWeakPtr(), error_code));
return;
}
scoped_refptr<base::SequencedTaskRunner> task_runner =