diff options
| author | amit@chromium.org <amit@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-05-19 23:12:42 +0000 |
|---|---|---|
| committer | amit@chromium.org <amit@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-05-19 23:12:42 +0000 |
| commit | 84415815e15b34b3a507731617f79673eb5d4601 (patch) | |
| tree | 3e70271306ea6e7ef2809dbbc8a868c6f8b76dac /chrome_frame | |
| parent | ca3dbf513dde28bb92b0337f87d2ed05c43b75ff (diff) | |
| download | chromium_src-84415815e15b34b3a507731617f79673eb5d4601.zip chromium_src-84415815e15b34b3a507731617f79673eb5d4601.tar.gz chromium_src-84415815e15b34b3a507731617f79673eb5d4601.tar.bz2 | |
Check correct offset to avoid crash
This change corrects the offset and the condition to avoid crash in
IBrowserService2::v_MayTranslateAccelerator.
BUG=25457
Review URL: http://codereview.chromium.org/2109010
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@47744 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'chrome_frame')
| -rw-r--r-- | chrome_frame/chrome_frame_activex_base.h | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/chrome_frame/chrome_frame_activex_base.h b/chrome_frame/chrome_frame_activex_base.h index de60462..9aa1cc3 100644 --- a/chrome_frame/chrome_frame_activex_base.h +++ b/chrome_frame/chrome_frame_activex_base.h @@ -918,7 +918,7 @@ END_MSG_MAP() // sent to the out of proc chromium instance. // Returns S_OK iff the accelerator was handled by the browser. HRESULT AllowFrameToTranslateAccelerator(const MSG& msg) { - static const int kMayTranslateAcceleratorOffset = 0x170; + static const int kMayTranslateAcceleratorOffset = 0x5c; // Although IBrowserService2 is officially deprecated, it's still alive // and well in IE7 and earlier. We have to use it here to correctly give // the browser a chance to handle keyboard shortcuts. @@ -941,7 +941,8 @@ END_MSG_MAP() // circumstances this vtable is actually used though. if (S_OK == DoQueryService(SID_STopLevelBrowser, m_spInPlaceSite, bs2.Receive()) && bs2.get() && - (bs2 + kMayTranslateAcceleratorOffset)) { + *(reinterpret_cast<long*>(bs2.get()) + + kMayTranslateAcceleratorOffset)) { hr = bs2->v_MayTranslateAccelerator(&accel_message); } else { // IE8 doesn't support IBrowserService2 unless you enable a special, |