Chromium Code Reviews
Help | Chromium Project | Gerrit Changes | Sign in
(69)

Issue 1060613002: IndexedDB: Protect against use-after-free in ChainedBlobWriter. (Closed)

Created:
4 years, 7 months ago by cmumford
Modified:
4 years, 7 months ago
Reviewers:
jsbell
CC:
cmumford, chromium-reviews, darin-cc_chromium.org, dgrogan, jam, jsbell+idb_chromium.org
Base URL:
https://chromium.googlesource.com/chromium/src.git@master
Target Ref:
refs/pending/heads/master
Project:
chromium
Visibility:
Public.

Description

IndexedDB: Protect against use-after-free in ChainedBlobWriter. This is a speculative fix for a heap user-after-free bug. Was unable to verify using a Windows SyzyASan build. The theory is that if Abort() was called before ChainedBlobWriterImpl::WriteNextFile() could set waiting_for_callback_ then the ReportWriteCompletion() would never know that it was aborted and attempt to use it's dangling raw pointer to a deleted IndexedDBBackingStore instance. Also in this change is the elimination of the redundant aborted_ member variable. BUG=472614 Committed: https://crrev.com/29777a8ee0f45b8160ec004e74013d5b62b6828a Cr-Commit-Position: refs/heads/master@{#326597}

Patch Set 1 #

Patch Set 2 : Formatted desctructor (one line) #

Unified diffs Side-by-side diffs Delta from patch set Stats (+9 lines, -12 lines) Patch
M content/browser/indexed_db/indexed_db_backing_store.cc View 1 3 chunks +9 lines, -12 lines 0 comments Download

Messages

Total messages: 8 (2 generated)
cmumford
Still trying to repro on Windows, but wanted to throw up this CL for consideration.
4 years, 7 months ago (2015-04-03 17:56:59 UTC) #1
cmumford
jsbell: I tried again today, but cannot repro the SyzyASan failure for the associated bug. ...
4 years, 7 months ago (2015-04-21 21:49:04 UTC) #3
jsbell
lgtm
4 years, 7 months ago (2015-04-22 23:49:47 UTC) #4
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1060613002/10002
4 years, 7 months ago (2015-04-23 17:50:21 UTC) #6
commit-bot: I haz the power
Committed patchset #2 (id:10002)
4 years, 7 months ago (2015-04-23 18:56:22 UTC) #7
commit-bot: I haz the power
4 years, 7 months ago (2015-04-23 18:58:11 UTC) #8
Message was sent while issue was closed.
Patchset 2 (id:??) landed as
https://crrev.com/29777a8ee0f45b8160ec004e74013d5b62b6828a
Cr-Commit-Position: refs/heads/master@{#326597}

Powered by Google App Engine
This is Rietveld 408576698