Commit d35d0fb1 authored by mbarbella's avatar mbarbella Committed by Commit bot

Fix and IPC fuzzer top crasher in OnWorkerScriptLoaded.

A compromised renderer can pass an arbitrary |provider_id|, so we should ensure that |provider_host| is not NULL and remove the DCHECK.

See https://cluster-fuzz.appspot.com/testcase?key=4713217552023552

R=falken@chromium.org,nhiroki@chromium.org

Review URL: https://codereview.chromium.org/901243002

Cr-Commit-Position: refs/heads/master@{#314881}
parent fa5eafe0
...@@ -690,7 +690,11 @@ void ServiceWorkerDispatcherHost::OnWorkerScriptLoaded( ...@@ -690,7 +690,11 @@ void ServiceWorkerDispatcherHost::OnWorkerScriptLoaded(
ServiceWorkerProviderHost* provider_host = ServiceWorkerProviderHost* provider_host =
GetContext()->GetProviderHost(render_process_id_, provider_id); GetContext()->GetProviderHost(render_process_id_, provider_id);
DCHECK(provider_host); if (!provider_host) {
BadMessageReceived();
return;
}
provider_host->SetReadyToSendMessagesToWorker(thread_id); provider_host->SetReadyToSendMessagesToWorker(thread_id);
EmbeddedWorkerRegistry* registry = GetContext()->embedded_worker_registry(); EmbeddedWorkerRegistry* registry = GetContext()->embedded_worker_registry();
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment