diff options
| author | teravest@chromium.org <teravest@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-04-26 22:02:53 +0000 |
|---|---|---|
| committer | teravest@chromium.org <teravest@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-04-26 22:02:53 +0000 |
| commit | 6018116f1cd8989b77a5f29b7afa5616875cad6d (patch) | |
| tree | cd9e9e90194b523aa8bd635b57508754f77422e1 /ppapi/proxy/plugin_var_tracker.h | |
| parent | 7eac08ec6eb00fbfbcd8c9dfb87ab64b2ef598bc (diff) | |
| download | chromium_src-6018116f1cd8989b77a5f29b7afa5616875cad6d.zip chromium_src-6018116f1cd8989b77a5f29b7afa5616875cad6d.tar.gz chromium_src-6018116f1cd8989b77a5f29b7afa5616875cad6d.tar.bz2 | |
Pepper: Fix use-after-free bug in PluginVarTracker.
A PluginDispatcher may destroy itself in reaction to a channel error. However,
ProxyObjectVar instances may still have a pointer to the (destroyed)
dispatcher. This is problematic when the plugin wants to send a message to the
host to release the object; the ProxyObjectVar doesn't know the
PluginDispatcher has been deleted.
This change alters PluginDispatcher to invoke DidDeleteDispatcher() on the
PluginVarTracker, which will clean up the dangling dispatcher pointers.
BUG=233044
Review URL: https://chromiumcodereview.appspot.com/14054020
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@196850 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'ppapi/proxy/plugin_var_tracker.h')
| -rw-r--r-- | ppapi/proxy/plugin_var_tracker.h | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/ppapi/proxy/plugin_var_tracker.h b/ppapi/proxy/plugin_var_tracker.h index a8b229397..ca8b978 100644 --- a/ppapi/proxy/plugin_var_tracker.h +++ b/ppapi/proxy/plugin_var_tracker.h @@ -59,7 +59,7 @@ class PPAPI_PROXY_EXPORT PluginVarTracker : public VarTracker { const PP_Var& host_object); // VarTracker public overrides. - void DidDeleteInstance(PP_Instance instance) OVERRIDE; + virtual void DidDeleteInstance(PP_Instance instance) OVERRIDE; virtual int TrackSharedMemoryHandle(PP_Instance instance, base::SharedMemoryHandle file, uint32 size_in_bytes) OVERRIDE; @@ -87,6 +87,8 @@ class PPAPI_PROXY_EXPORT PluginVarTracker : public VarTracker { bool ValidatePluginObjectCall(const PPP_Class_Deprecated* ppp_class, void* user_data); + void DidDeleteDispatcher(PluginDispatcher* dispatcher); + private: // VarTracker protected overrides. virtual int32 AddVarInternal(Var* var, AddVarRefMode mode) OVERRIDE; |