summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* [Backport] Security bug 1417585Tobias Tebbi2023-04-032-14/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/4294983: check if maps become deprecated during optimization (cherry picked from commit f82d802a20aa62e42269f977302f26c5c3ed031b) Bug: chromium:1417585 No-Try: true No-Presubmit: true No-Tree-Checks: true Change-Id: Ie8eb76d2afb3ee4be66cf5d1c4bff8f745dc145b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4255648 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#85848} Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4294983 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Achuith Bhandarkar <achuith@chromium.org> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/branch-heads/10.8@{#50} Cr-Branched-From: f1bc03fd6b4c201abd9f0fd9d51fb989150f97b9-refs/heads/10.8.168@{#1} Cr-Branched-From: 237de893e1c0a0628a57d0f5797483d3add7f005-refs/heads/main@{#83672} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468515 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1418734 (2/2)Zakhar Voit2023-04-031-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4337742: Fix crash in AnnotationAgentImpl This crash was occurring because the EphemeralRangeInFlatTree didn't produce a Node. This is surprising since the RangeInFlatTree that it comes from is checked for !IsCollapsed(). It turns out it's possible for RangeInFlatTree to be !IsCollapsed but converting to EphemeralRangeInFlatTree causes IsCollapsed. This CL ensures we early-out in the case that's tripping the CHECK. It keeps the early-out exactly matching the CHECK since it must be merged so we want to be extra sure. A followup will change this condition to !EphemeralRangeInFlatTree::IsCollapsed which should be equivalent. (cherry picked from commit 92782b6d34b7a5e26d184e217f8f44e97539686e) Bug: 1419712, 1418734 Change-Id: Id1d66a7a67711d463780b37c00600183d6c14f32 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4304486 Commit-Queue: David Bokan <bokan@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1112568} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4337742 Reviewed-by: Achuith Bhandarkar <achuith@chromium.org> Owners-Override: Achuith Bhandarkar <achuith@chromium.org> Commit-Queue: Zakhar Voit <voit@google.com> Cr-Commit-Position: refs/branch-heads/5359@{#1409} Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468513 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1418734 (1/2)Peter Boström2023-04-034-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4296138: Convert known it != end() DCHECK failures to CHECK These have hit on DCHECK builds in the wild and precede erasing or dereferencing an iterator that is UB. This CL excludes DCHECK failures that precede non-DCHECK handling of the it != end() failures. Those should probably be rewritten as CHECKs but are less urgent and semi-orthogonal. Known crashes (one per file) are: crash/dc49e3cadab36d4c crash/0ee3427d25937024 crash/b89303e84d123019 crash/cc35183b861a4992 (cherry picked from commit 1aec0b297900a7b59bd24314dff239f3c5697f45) Bug: 1418734 Change-Id: I81ed7b45be33769e250c65c8bb7334a34be4380e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4288168 Commit-Queue: Peter Boström <pbos@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1109350} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4296138 Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Reviewed-by: Achuith Bhandarkar <achuith@chromium.org> Owners-Override: Achuith Bhandarkar <achuith@chromium.org> Reviewed-by: Peter Boström <pbos@chromium.org> Cr-Commit-Position: refs/branch-heads/5359@{#1406} Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468512 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1415249Joyee Cheung2023-04-031-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/4290868: Merged: [ic] store slow stubs for objects with access checks in DefineNamedIC The CheckIfCanDefine() used to check the attributes of the object as well as reporting to access check failure callbacks can update the lookup iterator, resulting in wrong store handlers being installed. Restart the lookup iterator in this case to make sure that slow handlers are installed. Bug: chromium:1415249 (cherry picked from commit da2df213bc70437ef76f47e0ab6995fa45f8014a) Change-Id: I92d60af7ea798d80b1115e63b7fce8e2e8026ed9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4290868 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/branch-heads/11.0@{#33} Cr-Branched-From: 06097c6f0c5af54fd5d6965d37027efb72decd4f-refs/heads/11.0.226@{#1} Cr-Branched-From: 6bf3344f5d9940de1ab253f1817dcb99c641c9d3-refs/heads/main@{#84857} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468511 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1402921Luis Fernando Pardo Sixtos2023-04-031-1/+0
| | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/4144619: [shared-struct] Disallow SharedArray inline element access. There is no path to handle inline element access requiring a shared barrier check. Change-Id: Ia16d4792a136adebb753cc1eee9d2f45baeb0e46 Bug: v8:12547, chromium:1402921 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4144619 Commit-Queue: Luis Fernando Pardo Sixtos <lpardosixtos@microsoft.com> Reviewed-by: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#85160} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468510 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1337747Danil Somsikov2023-04-031-1/+1
| | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/4184203: Fix error dispatch in the v8 inspector session. Bug: chromium:1337747 Change-Id: I920f3c6370ac9f9bc351eff34e46b1e8d520fe3e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4184203 Auto-Submit: Danil Somsikov <dsv@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/main@{#85449} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468509 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1412991Eugene Zemtsov2023-04-033-6/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4279045: webcodecs: Fix VP9 p2 encoding of NV12 frames (cherry picked from commit 503831d1bdfdbe20c096f04cefc2231efd9ca4c0) (cherry picked from commit 2a98a1c69f6df6c93bddfeba6f1ea887c8e23d8a) Bug: 1412991 Change-Id: I2e596f65170c1fc98c122bfb0ecff4b241feee15 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4250421 Commit-Queue: Eugene Zemtsov <eugene@chromium.org> Cr-Original-Original-Commit-Position: refs/heads/main@{#1105528} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4276661 Cr-Original-Commit-Position: refs/branch-heads/5563@{#709} Cr-Original-Branched-From: 3ac59a6729cdb287a7ee629a0004c907ec1b06dc-refs/heads/main@{#1097615} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4279045 Owners-Override: Achuith Bhandarkar <achuith@chromium.org> Commit-Queue: Zakhar Voit <voit@google.com> Reviewed-by: Achuith Bhandarkar <achuith@chromium.org> Cr-Commit-Position: refs/branch-heads/5359@{#1403} Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468508 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1532: Out of bounds read in GPU VideoDale Curtis2023-04-034-17/+46
| | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4342492: Improve checks for VideoFrame layouts. Adds a `VideoFrameLayout::IsValidForSize(size)` method which clients can use to verify a VideoFrameLayout for their purpose. Updates a few call sites to use the new verifier and adds tests. (cherry picked from commit 17f73200c066158330542c19d521c517586533a2) Fixed: 1421268 Change-Id: I51049ada6119eddb31cdd9b7edfe77ee65b1da7a Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4307674 Auto-Submit: Dale Curtis <dalecurtis@chromium.org> Commit-Queue: Dominick Ng <dominickn@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1116233} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4342492 Cr-Commit-Position: refs/branch-heads/5481@{#1361} Cr-Branched-From: 130f3e4d850f4bc7387cfb8d08aa993d288a67a9-refs/heads/main@{#1084008} (cherry picked from commit b5c9e5efe5dd5e3d19d3a4b7428ec99a85d5aa1f) Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468507 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1534: Out of bounds read in ANGLEGeoff Lang2023-04-031-0/+5
| | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4324998: Disable glShaderBinary in the passthrough cmd decoder. This matches the behaviour of the validating command decoder. The client does not use this function and it's not exposed to WebGL. Bug: 1422594 Change-Id: I87c670e4e80b0078fddb9f089b7ac7777a6debfa Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4324998 Commit-Queue: Geoff Lang <geofflang@chromium.org> Cr-Commit-Position: refs/heads/main@{#1115379} (cherry picked from commit 4a81311a62d853a43e002f45c6867f73c0accdab) Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468506 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1531: Use after free in ANGLEGeoff Lang2023-04-032-2/+74
| | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/angle/angle/+/4348335: M110: D3D11: Add logic to disassociate EGL image storages. The TextureStorage classes for External and EGLImages were missing the logic to disassociate from images. This lead to the images continuing to hold references to deleted storages. Bug: chromium:1415330 Change-Id: I8303f6751d87a9b0a52993c7d4e9509b086b93f3 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/4328347 Reviewed-by: Peng Huang <penghuang@chromium.org> Commit-Queue: Geoff Lang <geofflang@chromium.org> (cherry picked from commit a8720455fda43167465c3d2f9a13fca60c21f56e) Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/4348335 Reviewed-by: Shahbaz Youssefi <syoussefi@chromium.org> Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468505 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1530: Use after free in PDF (2/2)Tom Sepez2023-04-031-0/+19
| | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://pdfium-review.googlesource.com/c/pdfium/+/104511: More tightly validate XML names in CXFA_FFDocView::GetWidgetByName() Widget names must conform to XML name rules. -- Beef up tests while at it. Fixed: chromium:1419831 Change-Id: Id36b4a7b3d84aa0b74d54c91eed2f1a11da8298f Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/104511 Reviewed-by: Lei Zhang <thestig@chromium.org> Commit-Queue: Tom Sepez <tsepez@chromium.org> Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468504 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1530: Use after free in PDF (1/2)Tom Sepez2023-04-033-29/+41
| | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://pdfium-review.googlesource.com/c/pdfium/+/104833: Observe CPWL_* object destruction across CPDFSDK_Widget methods This is a simple fix to stop the symptoms while we investigate how to avoid mutations at these points in the first place. -- fix some nearby braces and annoying blank lines while at it. Bug: chromium:1419831 Change-Id: I20c38806b91c7c0c9016bb1b567a04ce319243d8 Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/104397 Commit-Queue: Tom Sepez <tsepez@chromium.org> Reviewed-by: Lei Zhang <thestig@chromium.org> (cherry picked from commit 63e3719f1ec20ee6db804b2b2d4b00680db18d9c) Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/104833 Auto-Submit: Tom Sepez <tsepez@chromium.org> (cherry picked from commit a0d16d18d072ce77e639a09ed211340a2ad9034e) Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468503 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1529: Out of bounds memory access in WebHIDMatt Reynolds2023-04-031-5/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4320692: hid: Handle empty input reports It's possible for a HID device to define its report descriptor such that one or more reports have no data fields within the report. When receiving these reports, the report buffer should contain only the report ID byte and no other data. Ensure that we do not read past the end of the buffer when handling zero-length input reports. (cherry picked from commit c9d77da78bc66c135520ac77873d67b89cdcaee6) Bug: 1419718 Change-Id: I51d32c20f6b16f0d2b0172e0a165469b6b79748c Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4296562 Commit-Queue: Matt Reynolds <mattreynolds@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1112009} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4320692 Commit-Queue: Reilly Grant <reillyg@chromium.org> Auto-Submit: Matt Reynolds <mattreynolds@chromium.org> Cr-Commit-Position: refs/branch-heads/5481@{#1341} Cr-Branched-From: 130f3e4d850f4bc7387cfb8d08aa993d288a67a9-refs/heads/main@{#1084008} (cherry picked from commit b041159d06adbf7487639bd33a261cc0270d7a34) Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468502 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1235: Type Confusion in DevToolsSimon Zünd2023-04-031-1/+3
| | | | | | | | | | | | | | | | | | | | | Cherry-pick of commit originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4150308: Ensure that invoked method is an actual v8::Function CallMethodOnFrame invokes a function part of an object which in turn is installed on globalThis. E.g. globalThis['foo'].bar(); CallMethodOnFrame already bails out if 'foo' or 'bar' can't be found, but we should also bail out if 'bar' is not an actual function. Fixed: 1404704 Change-Id: I67c0883a53b358176898bd04fad3c45cf98721ed Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4150308 Reviewed-by: David Bokan <bokan@chromium.org> Commit-Queue: Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/main@{#1091189} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468203 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1232: Insufficient policy enforcement in Resource TimingSohom2023-04-0318-142/+368
| | | | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/3976688: Report ResourceTiming entries for 204/205 status codes even when not navigating Bug: 1346924 Change-Id: I368885b3dfaa5647795f08213d410861114c1dfa Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3976688 Reviewed-by: Emily Stark <estark@chromium.org> Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org> Commit-Queue: Sohom Datta <dattasohom1@gmail.com> Cr-Commit-Position: refs/heads/main@{#1095047} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468202 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1233: Insufficient policy enforcement in Resource TimingHao Liu2023-04-031-0/+7
| | | | | | | | | | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4116604: Fix extension fingerprinting via resource timing entry This CL is to prevent resource timing entry being emitted for resources that are initiated in the Non main world. Test cases are added for resources initiated from both the main world and non main world. Bug: 1045681 Change-Id: I309b54dae63f56e8d1d71e5c33507623b0c80389 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4116604 Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> Reviewed-by: Lei Zhang <thestig@chromium.org> Commit-Queue: Hao Liu <haoliuk@chromium.org> Cr-Commit-Position: refs/heads/main@{#1088254} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468200 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1222: Heap buffer overflow in Web Audio APIHongchan Choi2023-04-037-14/+60
| | | | | | | | | | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originallt reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4150813: Handle a transitory state of context/destination correctly for AudioWorklet operation When the context resumes from a suspended state, it is possible for the internal (destination) and the external (context) state to be different in a rare case. This allows the non-worklet thread to touch the worklet-related objects, which can causes invalid access to the V8-managed memory space. This CL adds a check; if the context state is suspended it swaps the task runner right away without waiting until a resume() promise is resolved. Bug: 1403515 Test: The provided repro case doesn't crash ASAN anymore. Change-Id: Ic2ea7b0337c444b7dc7d9d8b7195ed3e9ac3955f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4150813 Reviewed-by: Michael Wilson <mjwilson@chromium.org> Commit-Queue: Hongchan Choi <hongchan@chromium.org> Cr-Commit-Position: refs/heads/main@{#1096948} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468178 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1220: Heap buffer overflow in UMAWill Harris2023-04-031-0/+6
| | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4289351: Fix potential out of bounds write in base::SampleVectorBase BUG=1417185 (cherry picked from commit 552939b035e724e022fedb90fd80cd008e441fcf) Change-Id: I70719d0f9afb81dda373f88ab3a1c177397659ec Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4265437 Commit-Queue: Will Harris <wfh@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1106984} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4289351 Commit-Queue: Zakhar Voit <voit@google.com> Reviewed-by: Victor-Gabriel Savu <vsavu@google.com> Owners-Override: Victor-Gabriel Savu <vsavu@google.com> Cr-Commit-Position: refs/branch-heads/5359@{#1397} Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468177 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1219: Heap buffer overflow in Metrics (3/3)Will Harris2023-04-031-2/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4280124: Prevent potential integer overflow in PersistentMemoryAllocator https://crrev.com/c/4250177 added an extra check for potential integer overflow in GetAllocSize but forgot to add the same check in GetBlock. This meant that it was possible to get a pointer to a block but calling GetAllocSize on the same block would return zero. This change makes the two functions consistent with each other so calling GetBlock on invalid data will return nullptr. BUG=1417317,1415328 (cherry picked from commit 81be8e8f2e13a9f1fe6d3150205a3c13af1db6e9) Change-Id: I8eb3d91bae4528fc97517d202baf337536a4c81f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4264177 Commit-Queue: Alexei Svitkine <asvitkine@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1107105} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4280124 Owners-Override: Victor-Gabriel Savu <vsavu@google.com> Reviewed-by: Victor-Gabriel Savu <vsavu@google.com> Commit-Queue: Zakhar Voit <voit@google.com> Cr-Commit-Position: refs/branch-heads/5359@{#1402} Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468176 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1219: Heap buffer overflow in Metrics (2/3)Will Harris2023-04-033-12/+0
| | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4279942: Do not register browser_watcher activity report with crashpad BUG=1415328 (cherry picked from commit f93c88303ccbb64014a575b8ae093aa166832922) Change-Id: I109f6dac083a69a26841ee5e975e02093ca4cbf6 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4257669 Commit-Queue: Will Harris <wfh@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1106253} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4279942 Reviewed-by: Victor-Gabriel Savu <vsavu@google.com> Commit-Queue: Zakhar Voit <voit@google.com> Owners-Override: Victor-Gabriel Savu <vsavu@google.com> Cr-Commit-Position: refs/branch-heads/5359@{#1401} Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468175 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1219: Heap buffer overflow in Metrics (1/3)Will Harris2023-04-031-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on: https://chromium-review.googlesource.com/c/chromium/src/+/4279513: Prevent potential integer overflow in PersistentMemoryAllocator BUG=1415328 (cherry picked from commit 19de280a0c28065acf2a7e001af5c981698a461c) Change-Id: I66dcae6a1aacc1310ddd715033b3704c932b9800 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4250177 Commit-Queue: Will Harris <wfh@chromium.org> Commit-Queue: Alexei Svitkine <asvitkine@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1105177} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4279513 Commit-Queue: Zakhar Voit <voit@google.com> Owners-Override: Victor-Gabriel Savu <vsavu@google.com> Reviewed-by: Victor-Gabriel Savu <vsavu@google.com> Cr-Commit-Position: refs/branch-heads/5359@{#1400} Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468174 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1218: Use after free in WebRTCHenrik Boström2023-04-033-3/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4291513: Shutdown RtpContributingSourceCache in Dispose(). The cache is an off-heap object, but it is owned by an on-heap object (RTCPeerConnection). Dispoing the owning object poisons memory owned by it, but the cache may have in-flight tasks (cache doing ClearCache in a delayed microtask). This CL adds a Shutdown() method to ensure the cache isn't doing anything in the next microtask after disposal. No reliable way to repro this has been found but the change should be safe so hoping we can land without tests. (cherry picked from commit 4d450ecd6ec7776c7505dcf7d2f04157ff3ba0eb) Bug: 1413628 Change-Id: I479aace9859f4c10cd75d4aa5a34808b4726299d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4247023 Commit-Queue: Henrik Boström <hbos@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1105653} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4291513 Reviewed-by: Achuith Bhandarkar <achuith@chromium.org> Owners-Override: Achuith Bhandarkar <achuith@chromium.org> Reviewed-by: Henrik Boström <hbos@chromium.org> Commit-Queue: Zakhar Voit <voit@google.com> Cr-Commit-Position: refs/branch-heads/5359@{#1404} Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468173 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1217: Stack buffer overflow in Crash reportingRobert Sesek2023-04-031-1/+7
| | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/crashpad/crashpad/+/4284559: win: Only process up to EXCEPTION_MAXIMUM_PARAMETERS in an EXCEPTION_RECORD The EXCEPTION_RECORD contains a NumberParameters field, which could store a value that exceeds the amount of space allocated for the ExceptionInformation array. Bug: chromium:1412658 Change-Id: Ibfed8eb6317e28d3addf9215cda7fffc32e1030d Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/4284559 Reviewed-by: Alex Gough <ajgo@chromium.org> Commit-Queue: Robert Sesek <rsesek@chromium.org> Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468172 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1215: Type Confusion in CSSSteinar H. Gunderson2023-04-031-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4306796: In Typed CSSOM, reject adding to something that is not a list. M108 merge issues: third_party/blink/renderer/core/css/cssom/style_property_map.cc: The check before the added IsValueList check isn't present in 108 (cherry picked from commit 7301cf1e40fdd97594ea491676b867cf4e577edc) Fixed: 1417176 Change-Id: Idef1a81af46d334c181979778c28f19ce6369718 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4293477 Commit-Queue: Steinar H Gunderson <sesse@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1110281} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4306796 Commit-Queue: Zakhar Voit <voit@google.com> Reviewed-by: Steinar H Gunderson <sesse@chromium.org> Owners-Override: Achuith Bhandarkar <achuith@chromium.org> Reviewed-by: Achuith Bhandarkar <achuith@chromium.org> Cr-Commit-Position: refs/branch-heads/5359@{#1405} Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468171 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1214: Type Confusion in V8Marja Hölttä2023-04-031-23/+24
| | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/4290144: Merged: [valueserializer] Fix map transition chain following w/ dictionary maps Map::Update might return a dictionary map, and the calling code didn't take it into account. Bug: chromium:1412487 (cherry picked from commit b0db6637936a88807b5512a4de68145d0a9d6f02) Change-Id: I01995340856b5e21d1cda51915e8a2543428cfc4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4290144 Reviewed-by: Lutz Vahl <vahl@chromium.org> Commit-Queue: Lutz Vahl <vahl@chromium.org> Reviewed-by: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/branch-heads/11.1@{#18} Cr-Branched-From: c77793a2ee5bfa7c5226dd8f622bf331b97a5a25-refs/heads/11.1.277@{#1} Cr-Branched-From: 95b79bf04ba3f9de87f7bad77bc2d7552e5dc4d7-refs/heads/main@{#85479} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468170 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* Fixup: Qt GN integrationAllan Sandfeld Jensen2023-04-032-15/+3
| | | | | | Change-Id: I23522acc5128a353a51159308141cac5e3711e50 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468330 Reviewed-by: Peter Varga <pvarga@inf.u-szeged.hu>
* Fixup: Fixes for building with MSVCAllan Sandfeld Jensen2023-04-031-5/+0
| | | | | | Change-Id: I8d01ac9d293d33ce6c464298ca1aa07d30486484 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468329 Reviewed-by: Peter Varga <pvarga@inf.u-szeged.hu>
* FIXUP: Move querying EGL extensions out of chromiumAllan Sandfeld Jensen2023-04-031-1/+1
| | | | | | | | Neither mac nor Windows have native EGL libraries. Change-Id: Ieff010795ed758484185be349949d961593466a1 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468328 Reviewed-by: Peter Varga <pvarga@inf.u-szeged.hu>
* Fixup: Use ui::Compositor (3rdparty)Allan Sandfeld Jensen2023-04-033-12/+2
| | | | | | | | Painting cleanup. Remove some no longer needed calls, and pass through renderer_settings. Change-Id: I04c5a36b4462c896ec5ef2c96e552a310493a064 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/466675 Reviewed-by: Peter Varga <pvarga@inf.u-szeged.hu>
* Fixup: [Revert] ui/gl: Remove WGL support on WindowsAllan Sandfeld Jensen2023-03-301-2/+2
| | | | | | Change-Id: If3cd4907bb6bef6728f72ec54a72e7bed40703e4 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468331 Reviewed-by: Peter Varga <pvarga@inf.u-szeged.hu>
* Add support for custom gn binary to license generatorMichal Klocek2023-03-291-12/+25
| | | | | | | | | | | | | | In case of generating licenses using gn targets add support for gn binary location. Also add a way to skip project generation, which in case of webengine will not work as we use out of root configutation and is not needed as this is not a part of gn recursive call. Task-number: QTBUG-88482 Change-Id: Ie2870bcadc6b1ab3e443374fdee6be29ba614c08 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/469344 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* FIXUP: Jumbo buildAllan Sandfeld Jensen2023-03-242-4/+4
| | | | | | Change-Id: I3484899300d95132ac26f3aec7029112c3dc85f1 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/466451 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1401571Dale Curtis2023-03-24120-2369/+10891
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Manual update of libdav1d to match the version introduced by patch https://chromium-review.googlesource.com/c/chromium/src/+/4114163: Roll src/third_party/dav1d/libdav1d/ 87f9a81cd..ed63a7459 (104 commits) This roll required a few changes to get working: - "properties" => "built in options" crossfile configuration change due to Meson deprecation. - generic config creation never worked, so fixed. - PPC64 configs were never checked in, so switched to generic. - copyright header changes for generate_sources. - Updated readme.chromium with potential issues that can arise. https://chromium.googlesource.com/external/github.com/videolan/dav1d.git/+log/87f9a81cd770..ed63a7459376 $ git log 87f9a81cd..ed63a7459 --date=short --no-merges --format='%ad %ae %s' 2022-12-09 jamrial dav1d: add an option to skip decoding some frame types 2022-12-08 jamrial picture: support creating and freeing refs without tile data 2022-12-07 gramner x86: Add 10bpc 8x32/32x8 itx AVX-512 (Ice Lake) asm 2022-12-07 gramner x86: Add minor DC-only IDCT optimizations 2022-12-13 gramner getbits: Fix assertion failure 2022-12-13 gramner checkasm: Fix integer overflow in refmvs test 2022-01-26 gramner dav1dplay: Update to new libplacebo API 2022-12-09 gramner Add minor getbits improvements 2022-12-09 gramner Add a separate getbits function for getting a single bit 2022-12-09 gramner Remove redundant zeroing in sequence header parsing 2022-12-09 gramner Set the correct default value of initial_display_delay 2022-12-09 jamrial tools: remove the null last entry in inloop_filters_tbl 2022-12-04 lu_zero Do not assume the picture allocation starts as the left edge 2022-11-21 lu_zero ppc: Allocate the correct temp buffer size 2022-11-21 lu_zero ppc: Do not use static const with vec_splats 2022-11-02 charlie.c.hayden Add info to dav1d_send_data docs 2022-10-30 jbeich build: drop -D_DARWIN_C_SOURCE on macOS/iOS after 6b611d36acab 2022-10-30 jbeich build: drop -D_POSIX_C_SOURCE on non-Linux after 6b611d36acab 2022-06-28 victorien threading: Add a pending list for async task insertion 2022-10-26 martin Implement atomic_compare_exchange_strong in the atomic compat headers 2022-10-06 victorien threading: Fix a race around frame completion (frame-mt) 2022-10-07 sebastian Handle host_machine.system() 'ios' and 'tvos' the same way as 'darwin' 2022-09-23 gramner x86: Add 10-bit 8x8/8x16/16x8/16x16 itx AVX-512 (Ice Lake) asm 2022-09-30 gramner Specify hidden visibility for global data symbol declarations 2022-09-28 gramner build: strip() the result of cc.get_define() 2022-09-26 gramner checkasm: Move printf format string to .rodata on x86 2022-09-26 gramner checkasm: Improve 32-bit parameter clobbering on x86-64 2022-09-26 gramner x86: Fix incorrect 32-bit parameter usage in high bit-depth AVX-512 mc 2022-09-09 martin arm: itx: Add clipping to row_clip_min/max in the 10 bpc codepaths 2022-09-15 gramner x86: Fix overflows in 12bpc AVX2 IDCT/IADST 2022-09-15 gramner x86: Fix overflows in 12bpc AVX2 DC-only IDCT 2022-09-15 gramner x86: Fix clipping in high bit-depth AVX2 4x16 IDCT 2022-03-21 martin Don't use gas-preprocessor with clang-cl for arm targets 2022-06-07 david_conrad Fix checking the reference dimesions for the projection process 2022-06-07 david_conrad Fix calculation of OBMC lap dimensions 2022-06-07 david_conrad Support film grain application whose only effect is clipping to video range 2022-06-07 david_conrad Ignore T.35 metadata if the OBU contains no payload 2022-06-07 david_conrad Fix chroma deblock filter size calculation for lossless 2022-06-07 david_conrad Fix rounding in the calculation of initialSubpelX 2022-06-07 david_conrad Fix overflow when saturating dequantized coefficients clipped to 0 2022-06-08 david_conrad Fix overflow in 8-bit NEON ADST 2022-09-14 martin tools: Allocate the priv structs with proper alignment 2022-09-08 gramner x86: Fix clipping in 10bpc SSE4.1 IDCT asm 2022-09-08 gramner build: Improve Windows linking options 2022-09-08 gramner tools: Improve demuxer probing 2022-08-30 code CI: Disable trimming on some tests 2022-08-30 code CI: Remove git 'safe.directory' config 2022-08-30 code gcovr: Ignore parsing errors 2022-08-30 code crossfiles: Update Android toolchains 2022-08-30 code CI: Update images (...) 2022-09-01 victorien checkasm: Add short options 2022-09-01 victorien checkasm: Add pattern matching to --test 2022-09-01 victorien checkasm: Remove pattern matching from --bench 2022-08-29 victorien checkasm: Add a --function option 2022-08-30 victorien threading: Fix copy_lpf_progress initialization 2022-08-19 jamrial data: don't overwrite the Dav1dDataProps size value 2022-07-18 gramner Adjust inlining attributes on some functions 2022-07-19 gramner x86: Remove leftover instruction in loopfilter AVX2 asm 2022-06-07 david_conrad Enable pointer authentication in assembly when building arm64e 2022-06-07 david_conrad Don't trash the return stack buffer in the NEON loop filter 2022-07-03 thresh CI: Removed snap package generation 2022-07-06 gramner Eliminate unused C DSP functions at compile time 2022-07-06 gramner cpu: Inline dav1d_get_cpu_flags() 2022-06-22 gramner x86: Add minor loopfilter asm improvements 2022-06-15 gramner checkasm: Speed up signal handling 2022-06-15 gramner checkasm: Improve seed generation on Windows 2022-06-20 gramner ci: Don't specify a specific MacOS version 2022-06-14 gramner x86: Add high bit-depth loopfilter AVX-512 (Ice Lake) asm 2022-06-13 victorien checkasm/lpf: Use operating dimensions 2022-06-03 gramner checkasm: Print the cpu model and cpuid signature on x86 2022-06-03 gramner checkasm: Add a vzeroupper check on x86 2022-06-02 gramner x86: Add a workaround for quirky AVX-512 hardware behavior 2022-05-31 victorien checkasm: Fix uninitialized variable 2022-05-14 code CI: Update coverage collecting 2022-05-05 code CI: Add a build with the minimum requirements 2022-05-05 code CI: Deactivate git 'safe.directory' 2022-03-24 code CI: Update images 2022-05-25 victorien Fix typo 2022-05-19 gramner x86: Add high bit-depth cdef_filter AVX-512 (Ice Lake) asm 2022-05-20 gramner checkasm: Print --help message to stderr instead of stdout 2022-05-20 gramner checkasm: Split cdef test into separate pri/sec/pri+sec parts 2022-05-20 gramner checkasm: Improve benchmarking of functions that modify their input 2022-05-18 b x86/itx_avx2: fix typo 2022-04-22 code CI: Add gcc12 and clang14 builds with mold linker 2022-04-26 code CI: Trigger documentation rebuild if configuration changes 2022-04-24 code meson/doc: Fix doxygen config 2022-04-28 gramner Use a relaxed memory ordering in dav1d_ref_inc() 2022-04-28 gramner Remove redundant code in dav1d_cdf_thread_unref() 2022-04-28 gramner Inline dav1d_ref_inc() 2022-04-24 code x86/itx: Add 32x8 12bpc AVX2 transforms 2022-04-24 code x86/itx: Add 8x32 12bpc AVX2 transforms 2022-04-24 code x86/itx: Deduplicate dconly code 2022-04-23 code lib: Fix typo in documentation 2022-04-07 jamrial obu: don't output invisible but showable key frames more than once 2022-04-07 jamrial obu: check that the frame referenced by existing_frame_idx is showable 2022-04-07 jamrial obu: check refresh_frame_flags is not equal to allFrames on Intra Only frames 2022-03-29 robux4 remove multipass wait from dav1d_decode_frame 2022-04-07 jamrial picture: ensure the new seq header and op param info flags are attached to the next visible picture in display order 2022-03-31 jamrial lib: add a function to query the decoder frame delay 2022-03-31 jamrial lib: split calculating thread count to its own function Created with: roll-dep src/third_party/dav1d/libdav1d Fixed: 1401571 Change-Id: Ic3cef540a87a2cf411abe6071fd4c9963ea61f75 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4114163 Reviewed-by: Wan-Teh Chang <wtc@google.com> Commit-Queue: Dale Curtis <dalecurtis@chromium.org> Cr-Commit-Position: refs/heads/main@{#1084574} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468514 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Fixes for building with GCC-13Martin Negyokru2023-03-2228-1/+38
| | | | | | | | | Pick-to: 102-based Pick-to: 87-based Fixes: QTBUG-111697 Change-Id: I51fca3b3eb627b2617ff5c6c051fa1182671244d Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/464490 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Opus needs perl for optimatizationsMichal Klocek2023-03-201-1/+2
| | | | | | | Task-number: QTBUG-111958 Change-Id: I4a5074e3a39300f6ae02b160c41f94d3f00e0aa1 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/467012 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Revert "DrawingBuffer: Remove RGB emulation support"Michael Brüning2023-03-113-8/+114
| | | | | | | | | This reverts commit d2e9d29408e6cc3e1e6aa07686f4ae4403334619. Task-number: QTBUG-111585 Change-Id: Ic0a9ab30cdbc7d38c40d50b4bb1c4fe468a5402b Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/465958 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Fixup: "Revert "Remove unused ProduceRGBEmulationGLTexture calls with its ↵Michael Brüning2023-03-111-1/+1
| | | | | | | | | | | | | | | usage."" It was assigning the wrong value to SHARED_IMAGE_RGB_EMULATION: 19 rather than 1 << 19. This fixed the WebGL issue by accident, but also resulted in wrong behavior in video rendering. Task-number: QTBUG-111784 Change-Id: I0bebb231a8d4835e0250cdd6de3ae8651d0aece2 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/465957 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* FIXUP: Workaround debug iterator issues with MSVCMartin Negyokru2023-03-111-0/+2
| | | | | | | Fixes: QTBUG-111496 Change-Id: I37c1451ad0d033ab46fabdfb71afbe9381e70330 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/465862 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Revert "Remove unused ProduceRGBEmulationGLTexture calls with its usage."Michael Brüning2023-03-0334-31/+293
| | | | | | | | It is needed for WebGL on macOS. Change-Id: I3c6dad9e4ed23acb543de4a0037e4023d36d8f3b Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/464061 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2023-0931: Use after free in Video (2/2)Dale Curtis2023-02-274-64/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4225393: Further simplify WebMediaPlayerMSCompositor lifetime. M108 merge issues: third_party/blink/renderer/modules/mediastream/webmediaplayer_ms.cc: - video_task_runner_ is named io_task_runner_ in 108 third_party/blink/renderer/modules/mediastream/webmediaplayer_ms_compositor.cc: - video_task_runner_ is named io_task_runner_ in 108 (conflict in ReplaceCurrentFrameWithACopy) Due to the raw pointer held by VideoFrameSubmitter, there may be tasks pending on the compositor task runner after the RefCounted traits have "destructed" WebMediaPlayerMSCompositor. Through this raw pointer VFS was invoking OnContextLost which attempts to use the zero ref count compositor. The solution here is again similar to VideoFrameCompositor, its destruction should be explicit instead of a tangle of RefCounted owners. (cherry picked from commit 1622bffc6534a0cc4f53d07c43e0cd8f49975d10) Fixed: 1407701, 1411601 Change-Id: Ic77294d1113d54ab83bc0f5b625a997edf57bf7c Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4210508 Commit-Queue: Tony Herre <toprice@chromium.org> Auto-Submit: Dale Curtis <dalecurtis@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1099726} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4225393 Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Reviewed-by: Oleh Lamzin <lamzin@google.com> Owners-Override: Oleh Lamzin <lamzin@google.com> Cr-Commit-Position: refs/branch-heads/5359@{#1392} Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/462815 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-0931: Use after free in Video (1/2)Dale Curtis2023-02-273-32/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4225498: Simplify WebMediaPlayerMSCompositor destruction. The code was only sometimes calling StopUsingProvider() and posted the submitter destruction unnecessarily. Destruction now works the same as in VideoFrameCompositor, where the class itself is responsible for calling StopUsingProvider() during its own destruction. (cherry picked from commit cbd238e85903b7d94910bd2c6362ff9abf9908cc) Fixed: 1407701 Disallow-Recycled-Builds: test-failures Change-Id: Ia649cb5532519468eea34e12745ed9c990580d82 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4195824 Auto-Submit: Dale Curtis <dalecurtis@chromium.org> Commit-Queue: Tony Herre <toprice@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1098505} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4225498 Reviewed-by: Oleh Lamzin <lamzin@google.com> Owners-Override: Oleh Lamzin <lamzin@google.com> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Cr-Commit-Position: refs/branch-heads/5359@{#1391} Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/462814 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1414224Tommy C. Li2023-02-271-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4274984: Exclude Policy and Play API engines from Sync merging There's a security bug in which the call to ResetTemplateURLGUID can cause a policy-created engine to be deleted. This means that after the call, either the current `conflicting_turl` pointer, or future iterations in the loop may point to an already-freed TemplateURL, causing the use-after free bug. This CL addresses that by forbidding Policy-created and Play API engines from being merged into Synced engines. Although Play API engines aren't directly affected, they seem to also not be something that should be merged to Synced engines. (cherry picked from commit 315632458eb795ef9d9dce3fd1062f9e6f2c2077) Bug: 1414224 Change-Id: Ide43d71e9844e04a7ffe2e7ad2a522b6ca1535a3 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4250623 Commit-Queue: Tommy Li <tommycli@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1106249} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4274984 Commit-Queue: Krishna Govind <govind@chromium.org> Cr-Commit-Position: refs/branch-heads/5481@{#1238} Cr-Branched-From: 130f3e4d850f4bc7387cfb8d08aa993d288a67a9-refs/heads/main@{#1084008} (cherry picked from commit 06851790480e8e16a2913461d271437d525451a2) Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/462818 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-0928: Use after free in SwiftShaderPeng Huang2023-02-272-1/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4232858: Fix UAF problem in AngleVulkanImageBacking Right now, we use vulkan fence helper to release the backing. It is right, if the last usage of the backing is by skia. If the last usage is by gl, the fence helper(skia) isn't aware of the submitted work from ANGLE, skia may call flush finish callback to release the backing while the backing is still being referenced by works in ANGLE. Fix the problem by calling glFinish() if the last usage is GL. Know issue: the finish callback of skia flush() is not always called in order. So in edge cases, the UAF problem can still happen. Bug: 1309035 Change-Id: I3562043650dd2b27bde3a370bef45b1226cdd48c Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4232858 Reviewed-by: Vasiliy Telezhnikov <vasilyt@chromium.org> Commit-Queue: Peng Huang <penghuang@chromium.org> Cr-Commit-Position: refs/heads/main@{#1102905} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/462817 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-0933: Integer overflow in PDFLei Zhang2023-02-271-4/+16
| | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://pdfium-review.googlesource.com/c/pdfium/+/103078: Validate the page count. In CountPages(), which recursively calls itself, validate the page count. When any part of the pages tree contains bad data, bail out. Bug: chromium:1404864 Change-Id: Ifdbc14213ec3f963b4b2cb5793b83c15d03336e8 Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/103078 Reviewed-by: Tom Sepez <tsepez@chromium.org> Commit-Queue: Lei Zhang <thestig@chromium.org> Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/462816 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-0932: Use after free in WebRTCAlexander Cooper2023-02-271-8/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://webrtc-review.googlesource.com/c/src/+/292762: Fix Destruction inside WGC Callback If we are notified of the destruction of the window before a CaptureFrame call can fail, then we may end up attempting to destroy the underlying WGC object inside it's own event handler. This can be problematic, as the class itself may want to run other code. Instead, we just unsubscribe and signal that any future CaptureFrame calls should reject. This also removes setting "is_capture_started_=false" in the item closed handler, as all that served to do is cause the WgcCapturerWin code to attempt to restart the capturer, and somewhat muddies up our metrics. Bug: chromium:1413005 Change-Id: Ibccb7a2e7ce531ba80b4b331b9bc2cda0ff75f4e Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/292762 Auto-Submit: Alexander Cooper <alcooper@chromium.org> Reviewed-by: Mark Foltz <mfoltz@chromium.org> Commit-Queue: Mark Foltz <mfoltz@chromium.org> Commit-Queue: Alexander Cooper <alcooper@chromium.org> Cr-Commit-Position: refs/heads/main@{#39275} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/462813 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-0929: Use after free in VulkanVasiliy Telezhnikov2023-02-271-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4143606: CHECK that YUV readback finished synchronously DoReadbackYUVImagePixelsINTERNAL is implemented using skia asynchronous readback and to make it synchronous we use sync cpu and gpu. In some edge cases on linux we saw that doesn't happen if readback triggered vulkan device lost. To avoid use after free, CHECK that callback was actually called. In case of device-lost gpu process will restart anyway, so while this is not proper fix of the problem, it doesn't result in worse user visible behaviour. Bug: 1399742 Change-Id: Ie2172539bb907b9696ef62c70d398aca3967177c Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4143606 Reviewed-by: Peng Huang <penghuang@chromium.org> Commit-Queue: Vasiliy Telezhnikov <vasilyt@chromium.org> Cr-Commit-Position: refs/heads/main@{#1093064} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/462812 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-0941: Use after free in PromptsThomas Nguyen2023-02-272-11/+18
| | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4277341: Skip finalizing permission requests in pending queue Bug: 1415366 (cherry picked from commit dd597022c93047e88f6ddb812eb04ed392222b33) Change-Id: I2bd464a202354d9941bed8498bd44b5c5ebea6de Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4271191 Commit-Queue: Thomas Nguyen <tungnh@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1107426} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4277341 Commit-Queue: Srinivas Sista <srinivassista@chromium.org> Owners-Override: Srinivas Sista <srinivassista@chromium.org> Cr-Commit-Position: refs/branch-heads/5414@{#1524} Cr-Branched-From: 4417ee59d7bf6df7a9c9ea28f7722d2ee6203413-refs/heads/main@{#1070088} (cherry picked from commit 2bd849cc947cff0607666fd9225f0f552f3c6f8b) Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/462618 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* Add checksum to mailbox name in Release build tooPeter Varga2023-02-231-1/+1
| | | | | | | | | | | The lack of checksum may cause assert and error messages when a mailbox is passed from a release render process to a debug render process. Task-number: QTBUG-110504 Pick-to: 87-based 102-based Change-Id: Ib7d78e1e86a3f2ddda6dc8066abf9198040c38f6 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/461554 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* FIXUP: Fixes for building with MSVCPeter Varga2023-02-221-1/+1
| | | | | | Change-Id: I2aec8caffeebadc9feed34e64769149ffcb42172 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/461405 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Fixup for [Backport] CVE-2023-0705: Integer overflow in Core (2/2)Michael Brüning2023-02-211-0/+1
| | | | | | | | It was missing an include. Change-Id: If33119a15942ad58bed3fdf03ab97031e641454a Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/461649 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
View Lorry Controller Status