Commit 34f1357a authored by Finnur Thorarinsson's avatar Finnur Thorarinsson Committed by Commit Bot

Windows Native Notifications: Store arguments on stack.

This prevents a UaF in notification_helper, triggered by
the fact that c_str() points to a deleted string when the
ShellExecute call runs.

TBR: robliao, chengx
Bug: 734095
Change-Id: I17437368254fb138d1a3fe5db432dba86e30c161
Reviewed-on: https://chromium-review.googlesource.com/937702Reviewed-by: default avatarPeter Beverloo <peter@chromium.org>
Commit-Queue: Finnur Thorarinsson <finnur@chromium.org>
Cr-Commit-Position: refs/heads/master@{#539182}
parent 1aa9101b
......@@ -87,7 +87,8 @@ HRESULT NotificationActivator::Activate(
info.cbSize = sizeof(info);
info.fMask = SEE_MASK_NOASYNC | SEE_MASK_FLAG_LOG_USAGE;
info.lpFile = chrome_exe_path.value().c_str();
info.lpParameters = command_line.GetCommandLineString().c_str();
base::string16 arguments(command_line.GetCommandLineString());
info.lpParameters = arguments.c_str();
info.nShow = SW_SHOWNORMAL;
if (!::ShellExecuteEx(&info)) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment