Commit b8e5a41e authored by Minoru Chikamune's avatar Minoru Chikamune Committed by Commit Bot

Fix Null-dereference READ in scoped_refptr<mojo::SimpleWatcher::Context>::operator bool

ClusterFuzz found null-dereference READ in
scoped_refptr<mojo::SimpleWatcher::Context>::operator bool.
This bug already existed before HeapMojo wrappers were introduced.
We are not sure the root cause, but HeapMojo wrappers could sanitize
the issue.

Bug: 1049056, 1079286
Change-Id: I9f0fae6921024525891841bc942ac3a521a0a015
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2208780Reviewed-by: default avatarKouhei Ueno <kouhei@chromium.org>
Reviewed-by: default avatarKentaro Hara <haraken@chromium.org>
Reviewed-by: default avatarKeishi Hattori <keishi@chromium.org>
Commit-Queue: Minoru Chikamune <chikamune@chromium.org>
Cr-Commit-Position: refs/heads/master@{#770808}
parent cfabb5a3
...@@ -13,7 +13,6 @@ ...@@ -13,7 +13,6 @@
#include "third_party/blink/renderer/platform/heap/handle.h" #include "third_party/blink/renderer/platform/heap/handle.h"
#include "third_party/blink/renderer/platform/mojo/heap_mojo_remote.h" #include "third_party/blink/renderer/platform/mojo/heap_mojo_remote.h"
#include "third_party/blink/renderer/platform/mojo/heap_mojo_unique_receiver_set.h" #include "third_party/blink/renderer/platform/mojo/heap_mojo_unique_receiver_set.h"
#include "third_party/blink/renderer/platform/mojo/heap_mojo_wrapper_mode.h"
#include "third_party/blink/renderer/platform/supplementable.h" #include "third_party/blink/renderer/platform/supplementable.h"
namespace WTF { namespace WTF {
...@@ -200,17 +199,12 @@ class FileSystemDispatcher : public GarbageCollected<FileSystemDispatcher>, ...@@ -200,17 +199,12 @@ class FileSystemDispatcher : public GarbageCollected<FileSystemDispatcher>,
void Prefinalize(); void Prefinalize();
HeapMojoRemote<mojom::blink::FileSystemManager, HeapMojoRemote<mojom::blink::FileSystemManager> file_system_manager_;
HeapMojoWrapperMode::kWithoutContextObserver>
file_system_manager_;
using OperationsMap = using OperationsMap =
HashMap<int, mojo::Remote<mojom::blink::FileSystemCancellableOperation>>; HashMap<int, mojo::Remote<mojom::blink::FileSystemCancellableOperation>>;
OperationsMap cancellable_operations_; OperationsMap cancellable_operations_;
int next_operation_id_; int next_operation_id_;
HeapMojoUniqueReceiverSet< HeapMojoUniqueReceiverSet<mojom::blink::FileSystemOperationListener>
mojom::blink::FileSystemOperationListener,
std::default_delete<mojom::blink::FileSystemOperationListener>,
HeapMojoWrapperMode::kWithoutContextObserver>
op_listeners_; op_listeners_;
}; };
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment