bcarrella/cef
1
0
Fork 0
mirror of https://bitbucket.org/chromiumembedded/cef synced 2025-06-05 21:39:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix potential UAF of CefBPDNativeAura::window_widget_

Browse Source
This commit is contained in:
Marshall Greenblatt
2023-02-06 15:43:00 -08:00
parent adfa59f690
commit f34406c57d
6 changed files with 48 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
libcef/browser/native/window_delegate_view.cc
View File

@@ -15,11 +15,12 @@
CefWindowDelegateView::CefWindowDelegateView(
SkColor background_color,
bool always_on_top,
base::RepeatingClosure on_bounds_changed)
base::RepeatingClosure on_bounds_changed,
base::OnceClosure on_delete)
: background_color_(background_color),
web_view_(nullptr),
always_on_top_(always_on_top),
on_bounds_changed_(on_bounds_changed) {}
on_bounds_changed_(std::move(on_bounds_changed)),
on_delete_(std::move(on_delete)) {}
void CefWindowDelegateView::Init(gfx::AcceleratedWidget parent_widget,
content::WebContents* web_contents,
@@ -64,6 +65,10 @@ void CefWindowDelegateView::Init(gfx::AcceleratedWidget parent_widget,
DCHECK(widget->is_top_level());
// |widget| must be activatable for focus handling to work correctly.
DCHECK(widget->widget_delegate()->CanActivate());
// WidgetDelegate::DeleteDelegate() will execute the registered callback.
RegisterDeleteDelegateCallback(base::BindOnce(
&CefWindowDelegateView::DeleteDelegate, base::Unretained(this)));
}
void CefWindowDelegateView::InitContent() {
@@ -72,6 +77,12 @@ void CefWindowDelegateView::InitContent() {
AddChildView(web_view_);
}
void CefWindowDelegateView::DeleteDelegate() {
if (!on_delete_.is_null()) {
std::move(on_delete_).Run();
}
}
void CefWindowDelegateView::ViewHierarchyChanged(
const views::ViewHierarchyChangedDetails& details) {
if (details.is_add && details.child == this) {