Commit 12561d34 authored by Dan Sanders's avatar Dan Sanders Committed by Commit Bot

[webcodecs] Fix UaF in VideoFrame::CreateImageBitmap

The lifetime was reduced in commit 8d00b895,
making the use of base::Unretained() unsafe in this case.

Bug: 1142675
Change-Id: I57e16ee028c02313601b9a611e7e335dfdcb4aff
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2504592Reviewed-by: default avatarEugene Zemtsov <eugene@chromium.org>
Commit-Queue: Dan Sanders <sandersd@chromium.org>
Cr-Commit-Position: refs/heads/master@{#821536}
parent 536193da
......@@ -413,10 +413,13 @@ ScriptPromise VideoFrame::CreateImageBitmap(ScriptState* script_state,
ri->GenUnverifiedSyncTokenCHROMIUM(sync_token.GetData());
auto release_callback = viz::SingleReleaseCallback::Create(base::BindOnce(
[](gpu::SharedImageInterface* sii, gpu::Mailbox mailbox,
const gpu::SyncToken& sync_token,
bool is_lost) { sii->DestroySharedImage(sync_token, mailbox); },
base::Unretained(shared_image_interface), dest_holder.mailbox));
[](scoped_refptr<viz::RasterContextProvider> provider,
gpu::Mailbox mailbox, const gpu::SyncToken& sync_token,
bool is_lost) {
provider->SharedImageInterface()->DestroySharedImage(sync_token,
mailbox);
},
raster_context_provider, dest_holder.mailbox));
const SkImageInfo sk_image_info =
SkImageInfo::Make(codedWidth(), codedHeight(), kN32_SkColorType,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment