diff options
| author | deanm@chromium.org <deanm@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2009-02-12 13:49:26 +0000 |
|---|---|---|
| committer | deanm@chromium.org <deanm@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2009-02-12 13:49:26 +0000 |
| commit | 1a842f967fa5ae7d8bc6cea50d63157bdbc5d010 (patch) | |
| tree | c69a1e3f2150ac84f2660d3ddfcfce68329390cf /chrome/browser/renderer_host | |
| parent | 212b30d4e8c264d565fedadb3c1bb8c649779299 (diff) | |
| download | chromium_src-1a842f967fa5ae7d8bc6cea50d63157bdbc5d010.zip chromium_src-1a842f967fa5ae7d8bc6cea50d63157bdbc5d010.tar.gz chromium_src-1a842f967fa5ae7d8bc6cea50d63157bdbc5d010.tar.bz2 | |
Validate HWNDs that the renderer asks to be moved.
We make sure any window is a child of the render view window before moving it.
BUG=7590
Review URL: http://codereview.chromium.org/24012
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@9651 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'chrome/browser/renderer_host')
| -rw-r--r-- | chrome/browser/renderer_host/render_widget_host_view_win.cc | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/chrome/browser/renderer_host/render_widget_host_view_win.cc b/chrome/browser/renderer_host/render_widget_host_view_win.cc index b499669..72d0b0a 100644 --- a/chrome/browser/renderer_host/render_widget_host_view_win.cc +++ b/chrome/browser/renderer_host/render_widget_host_view_win.cc @@ -165,6 +165,13 @@ void RenderWidgetHostViewWin::MovePluginWindows( if (!::IsWindow(move.window)) continue; + // The renderer should only be trying to move windows that are children + // of its render widget window. + if (::IsChild(m_hWnd, move.window) == 0) { + NOTREACHED(); + continue; + } + if (move.visible) flags |= SWP_SHOWWINDOW; else |