GitLab

The specific UAF happens as a views::Checkbox callback deletes the
dialog in which it was hosted. Because the client pointer is cached in
InputMethodAuraLinux::ProcessKeyEventDone there's UAF after that point.

The fix checks if GetTextInputClient() has changed after InsertChar() or
InsertText() and returns early, stopping event propagation.

Bug: 1125187
Change-Id: Id6a277858adf69011d56627893a98b5603eee503
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2399245Reviewed-by: Yuichiro Hanada <yhanada@chromium.org>
Commit-Queue: Peter Boström <pbos@chromium.org>
Cr-Commit-Position: refs/heads/master@{#805295}