diff options
| author | teravest@chromium.org <teravest@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-04-26 22:02:53 +0000 |
|---|---|---|
| committer | teravest@chromium.org <teravest@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-04-26 22:02:53 +0000 |
| commit | 6018116f1cd8989b77a5f29b7afa5616875cad6d (patch) | |
| tree | cd9e9e90194b523aa8bd635b57508754f77422e1 /ppapi/proxy/plugin_dispatcher.cc | |
| parent | 7eac08ec6eb00fbfbcd8c9dfb87ab64b2ef598bc (diff) | |
| download | chromium_src-6018116f1cd8989b77a5f29b7afa5616875cad6d.zip chromium_src-6018116f1cd8989b77a5f29b7afa5616875cad6d.tar.gz chromium_src-6018116f1cd8989b77a5f29b7afa5616875cad6d.tar.bz2 | |
Pepper: Fix use-after-free bug in PluginVarTracker.
A PluginDispatcher may destroy itself in reaction to a channel error. However,
ProxyObjectVar instances may still have a pointer to the (destroyed)
dispatcher. This is problematic when the plugin wants to send a message to the
host to release the object; the ProxyObjectVar doesn't know the
PluginDispatcher has been deleted.
This change alters PluginDispatcher to invoke DidDeleteDispatcher() on the
PluginVarTracker, which will clean up the dangling dispatcher pointers.
BUG=233044
Review URL: https://chromiumcodereview.appspot.com/14054020
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@196850 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'ppapi/proxy/plugin_dispatcher.cc')
| -rw-r--r-- | ppapi/proxy/plugin_dispatcher.cc | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/ppapi/proxy/plugin_dispatcher.cc b/ppapi/proxy/plugin_dispatcher.cc index 812b2e9..8cac63f 100644 --- a/ppapi/proxy/plugin_dispatcher.cc +++ b/ppapi/proxy/plugin_dispatcher.cc @@ -20,6 +20,7 @@ #include "ppapi/proxy/gamepad_resource.h" #include "ppapi/proxy/interface_list.h" #include "ppapi/proxy/interface_proxy.h" +#include "ppapi/proxy/plugin_globals.h" #include "ppapi/proxy/plugin_message_filter.h" #include "ppapi/proxy/plugin_resource_tracker.h" #include "ppapi/proxy/plugin_var_serialization_rules.h" @@ -77,6 +78,8 @@ PluginDispatcher::PluginDispatcher(PP_GetInterface_Func get_interface, } PluginDispatcher::~PluginDispatcher() { + PluginGlobals::Get()->plugin_var_tracker()->DidDeleteDispatcher(this); + if (plugin_delegate_) plugin_delegate_->Unregister(plugin_dispatcher_id_); |