bcarrella
/
cef
mirror of https://bitbucket.org/chromiumembedded/cef
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

osr: Fix potential shared memory OOB access

This commit is contained in:
Marshall Greenblatt 2024-01-05 12:14:58 -05:00
parent 9dc7653ddc
commit 1f55d2e12f
2 changed files with 19 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
libcef/browser/osr/host_display_client_osr.cc
View File

@ -75,15 +75,24 @@ void CefLayeredWindowUpdaterOSR::OnAllocatedSharedMemory(
base::UnsafeSharedMemoryRegion region) { base::UnsafeSharedMemoryRegion region) {
// Make sure |pixel_size| is sane. // Make sure |pixel_size| is sane.
size_t expected_bytes; size_t expected_bytes;
bool size_result = viz::ResourceSizes::MaybeSizeInBytes( if (!viz::ResourceSizes::MaybeSizeInBytes(
pixel_size, viz::SinglePlaneFormat::kRGBA_8888, &expected_bytes); pixel_size, viz::SinglePlaneFormat::kRGBA_8888, &expected_bytes)) {
if (!size_result) { DLOG(ERROR) << "OnAllocatedSharedMemory with size that overflows";
return;
}
auto mapping = region.Map();
if (!mapping.IsValid()) {
DLOG(ERROR) << "Shared memory mapping failed.";
return;
}
if (mapping.size() < expected_bytes) {
DLOG(ERROR) << "Shared memory size was less than expected.";
return; return;
} }
pixel_size_ = pixel_size; pixel_size_ = pixel_size;
shared_memory_ = region.Map(); shared_memory_ = std::move(mapping);
DCHECK(shared_memory_.IsValid());
} }
void CefLayeredWindowUpdaterOSR::Draw(const gfx::Rect& damage_rect, void CefLayeredWindowUpdaterOSR::Draw(const gfx::Rect& damage_rect,

5
libcef/browser/osr/video_consumer_osr.cc
View File

@ -88,6 +88,11 @@ void CefVideoConsumerOSR::OnFrameCaptured(
callbacks) { callbacks) {
ScopedVideoFrameDone scoped_done(std::move(callbacks)); ScopedVideoFrameDone scoped_done(std::move(callbacks));
if (info->pixel_format != media::PIXEL_FORMAT_ARGB) {
DLOG(ERROR) << "Unsupported pixel format " << info->pixel_format;
return;
}
CHECK(data->is_read_only_shmem_region()); CHECK(data->is_read_only_shmem_region());
base::ReadOnlySharedMemoryRegion& shmem_region = base::ReadOnlySharedMemoryRegion& shmem_region =
data->get_read_only_shmem_region(); data->get_read_only_shmem_region();