Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: crashes in RenderFrameImpl::OnSelectPopupMenuItem(s) #17659

Conversation

Projects
None yet
5 participants
@miniak
Copy link
Contributor

miniak commented Apr 2, 2019

Description of Change

Backport fix for https://bugs.chromium.org/p/chromium/issues/detail?id=912211
https://chromium-review.googlesource.com/c/chromium/src/+/1381325

Fix crashes in RenderFrameImpl::OnSelectPopupMenuItem(s)

ExternalPopupMenu::DidSelectItem(s) can delete the RenderFrameImpl.
We need to reset external_popup_menu_ before calling it.

/cc @electron/wg-security

Checklist

Release Notes

Notes: Backported fix for crashes in RenderFrameImpl::OnSelectPopupMenuItem(s).

@miniak miniak self-assigned this Apr 2, 2019

@miniak miniak requested a review from electron/wg-security Apr 2, 2019

@miniak miniak changed the title fix: Issue 912211: Security: a use-after-free in RenderFrameImple can lead to an RCE fix: backport 912211 Apr 2, 2019

@electron-cation electron-cation bot removed the new-pr 🌱 label Apr 3, 2019

@codebytere codebytere changed the title fix: backport 912211 fix: crashes in RenderFrameImpl::OnSelectPopupMenuItem(s) Apr 4, 2019

@codebytere codebytere merged commit 492397b into 4-1-x Apr 4, 2019

8 checks passed

Semantic Pull Request ready to be squashed
Details
appveyor: win-ia32-debug AppVeyor build succeeded
Details
appveyor: win-ia32-testing AppVeyor build succeeded
Details
appveyor: win-ia32-testing-pr AppVeyor build succeeded
Details
appveyor: win-x64-debug AppVeyor build succeeded
Details
appveyor: win-x64-testing AppVeyor build succeeded
Details
appveyor: win-x64-testing-pr AppVeyor build succeeded
Details
release-notes Release notes found
@release-clerk

This comment has been minimized.

Copy link

release-clerk bot commented Apr 4, 2019

Release Notes Persisted

Backported fix for crashes in RenderFrameImpl::OnSelectPopupMenuItem(s).

@codebytere codebytere deleted the miniak/fix_crashes_in_renderframeimpl_onselectpopupmenuitem_s-4-1-x branch Apr 4, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.