Fix UAF in CachedStorageArea
CachedStorageArea is ref-counted and was retaining an unsafe reference to a GCed object which it may outlive. This changes that reference to a WeakPersistent and ensures that we don't dereference it once it's no longer valid. Fixed: 1048234 Change-Id: I9971b35b9aa7db790236f92c353a2320740f7729 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2036383 Commit-Queue: Ken Rockot <rockot@google.com> Commit-Queue: Victor Costan <pwnall@chromium.org> Reviewed-by:Daniel Murphy <dmurph@chromium.org> Reviewed-by:
Victor Costan <pwnall@chromium.org> Auto-Submit: Ken Rockot <rockot@google.com> Cr-Commit-Position: refs/heads/master@{#738424}
Showing
Please register or sign in to comment