Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore: cherry-pick 1 changes from Release-2-M119 #40537

Merged
merged 2 commits into from
Nov 20, 2023
Merged

chore: cherry-pick 1 changes from Release-2-M119 #40537

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7e73142
chore: [26-x-y] cherry-pick 1 changes from Release-2-M119
ppontes Nov 15, 2023
dbee0e9
chore: update patches
patchup[bot] Nov 15, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
1 change: 1 addition & 0 deletions patches/chromium/.patches
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,3 +142,4 @@ gpu_use_load_program_shader_shm_count_on_drdc_thread.patch
crash_gpu_process_and_clear_shader_cache_when_skia_reports.patch
cherry-pick-3df423a5b8de.patch
scale_rects_properly_in_syncgetfirstrectforrange.patch
cherry-pick-9384cddc7705.patch
42 changes: 42 additions & 0 deletions patches/chromium/cherry-pick-9384cddc7705.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Nidhi Jaju <nidhijaju@chromium.org>
Date: Wed, 8 Nov 2023 04:19:31 +0000
Subject: Make URLSearchParams persistent to avoid UaF

The URLSearchParams::Create() function returns an on-heap object, but it
can be garbage collected, so making it a persistent variable in
DidFetchDataLoadedString() mitigates the issue.

(cherry picked from commit 8b1bd7726a1394e2fe287f6a882822d8ee9d4e96)

Bug: 1497997
Change-Id: I4ae0f93fccc561cd8a088d3fa0bf2968bf298acf
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4996929
Reviewed-by: Adam Rice <ricea@chromium.org>
Commit-Queue: Nidhi Jaju <nidhijaju@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#1218682}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5007484
Commit-Queue: Adam Rice <ricea@chromium.org>
Auto-Submit: Nidhi Jaju <nidhijaju@chromium.org>
Cr-Commit-Position: refs/branch-heads/5993@{#1546}
Cr-Branched-From: 511350718e646be62331ae9d7213d10ec320d514-refs/heads/main@{#1192594}

diff --git a/third_party/blink/renderer/core/fetch/body.cc b/third_party/blink/renderer/core/fetch/body.cc
index 86aac83becddb7aad0b8172311ccf2cd182bc7e6..4f396c124a1e33772e447e8f8000f31937a57fa6 100644
--- a/third_party/blink/renderer/core/fetch/body.cc
+++ b/third_party/blink/renderer/core/fetch/body.cc
@@ -135,8 +135,13 @@ class BodyFormDataConsumer final : public BodyConsumerBase {

void DidFetchDataLoadedString(const String& string) override {
auto* formData = MakeGarbageCollected<FormData>();
- for (const auto& pair : URLSearchParams::Create(string)->Params())
+ // URLSearchParams::Create() returns an on-heap object, but it can be
+ // garbage collected, so making it a persistent variable on the stack
+ // mitigates use-after-free scenarios. See crbug.com/1497997.
+ Persistent<URLSearchParams> search_params = URLSearchParams::Create(string);
+ for (const auto& pair : search_params->Params()) {
formData->append(pair.first, pair.second);
+ }
DidFetchDataLoadedFormData(formData);
}
};