Commit c11f57b1 authored by Khushal's avatar Khushal Committed by Commit Bot

gpu: Ensure skottie is only deserialized for privileged channels.

We shouldn't be parsing json data from untrusted sources in the GPU
process. For this reason we allow skottie objects to be used only by the
GpuChannel associated with the browser process. Fix an error in
enforcing this.

R=malaykeshav@chromium.org

Bug: 894635
Change-Id: If5b0bfb3c95b7475e735b0b74e69d8c1cf533020
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2112334
Auto-Submit: Khushal <khushalsagar@chromium.org>
Commit-Queue: Malay Keshav <malaykeshav@chromium.org>
Reviewed-by: default avatarMalay Keshav <malaykeshav@chromium.org>
Cr-Commit-Position: refs/heads/master@{#752062}
parent 1b6f77d3
...@@ -2596,6 +2596,12 @@ void RasterDecoderImpl::DoCreateTransferCacheEntryINTERNAL( ...@@ -2596,6 +2596,12 @@ void RasterDecoderImpl::DoCreateTransferCacheEntryINTERNAL(
return; return;
} }
if (entry_type == cc::TransferCacheEntryType::kSkottie && !is_privileged_) {
LOCAL_SET_GL_ERROR(GL_INVALID_VALUE, "glCreateTransferCacheEntryINTERNAL",
"Attempt to use skottie on a non privileged channel");
return;
}
uint8_t* data_memory = uint8_t* data_memory =
GetSharedMemoryAs<uint8_t*>(data_shm_id, data_shm_offset, data_size); GetSharedMemoryAs<uint8_t*>(data_shm_id, data_shm_offset, data_size);
if (!data_memory) { if (!data_memory) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment