diff options
| author | bauerb@chromium.org <bauerb@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2011-02-24 08:53:46 +0000 |
|---|---|---|
| committer | bauerb@chromium.org <bauerb@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2011-02-24 08:53:46 +0000 |
| commit | 453ceaa3f9884073e373e5355ec73f6f647e4db4 (patch) | |
| tree | 040f9322184267eba96f4d0832af163f0cbe63c0 /webkit/plugins/npapi | |
| parent | 3afee730299549e164a3ce3de5bc01b0e37eca8a (diff) | |
| download | chromium_src-453ceaa3f9884073e373e5355ec73f6f647e4db4.zip chromium_src-453ceaa3f9884073e373e5355ec73f6f647e4db4.tar.gz chromium_src-453ceaa3f9884073e373e5355ec73f6f647e4db4.tar.bz2 | |
Don't access WebPluginInfo array out of bounds in PluginGroup::RemovePlugin.
BUG=73893
TEST=PluginGroupTest.MultipleVersions
Review URL: http://codereview.chromium.org/6579004
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@75858 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'webkit/plugins/npapi')
| -rw-r--r-- | webkit/plugins/npapi/plugin_group.cc | 6 | ||||
| -rw-r--r-- | webkit/plugins/npapi/plugin_group_unittest.cc | 4 |
2 files changed, 8 insertions, 2 deletions
diff --git a/webkit/plugins/npapi/plugin_group.cc b/webkit/plugins/npapi/plugin_group.cc index dd2bb1f..bd24f3d 100644 --- a/webkit/plugins/npapi/plugin_group.cc +++ b/webkit/plugins/npapi/plugin_group.cc @@ -246,12 +246,14 @@ void PluginGroup::AddPlugin(const WebPluginInfo& plugin) { bool PluginGroup::RemovePlugin(const FilePath& filename) { bool did_remove = false; ResetGroupState(); - for (size_t i = 0; i < web_plugin_infos_.size(); ++i) { + for (size_t i = 0; i < web_plugin_infos_.size();) { if (web_plugin_infos_[i].path == filename) { web_plugin_infos_.erase(web_plugin_infos_.begin() + i); did_remove = true; + } else { + UpdateActivePlugin(web_plugin_infos_[i]); + i++; } - UpdateActivePlugin(web_plugin_infos_[i]); } return did_remove; } diff --git a/webkit/plugins/npapi/plugin_group_unittest.cc b/webkit/plugins/npapi/plugin_group_unittest.cc index 9c2d137..28f8fe6 100644 --- a/webkit/plugins/npapi/plugin_group_unittest.cc +++ b/webkit/plugins/npapi/plugin_group_unittest.cc @@ -286,6 +286,10 @@ TEST(PluginGroupTest, MultipleVersions) { EXPECT_TRUE(group->RemovePlugin(kPlugin3044.path)); EXPECT_EQ(kPlugin3043.desc, group->description()); EXPECT_TRUE(group->IsVulnerable()); + + EXPECT_TRUE(group->RemovePlugin(kPlugin3043.path)); + EXPECT_TRUE(group->IsEmpty()); + EXPECT_EQ(string16(), group->description()); } } // namespace npapi |