bcarrella/cef
1
0
Fork 0
mirror of https://bitbucket.org/chromiumembedded/cef synced 2025-06-05 21:39:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix potential UAF of CefBPDNativeAura::window_widget_

Browse Source
This commit is contained in:
Marshall Greenblatt
2023-02-06 15:43:00 -08:00
parent adfa59f690
commit f34406c57d
6 changed files with 48 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
libcef/browser/native/window_delegate_view.h
View File

@@ -22,7 +22,8 @@ class CefWindowDelegateView : public views::WidgetDelegateView {
public:
CefWindowDelegateView(SkColor background_color,
bool always_on_top,
base::RepeatingClosure on_bounds_changed);
base::RepeatingClosure on_bounds_changed,
base::OnceClosure on_delete);
CefWindowDelegateView(const CefWindowDelegateView&) = delete;
CefWindowDelegateView& operator=(const CefWindowDelegateView&) = delete;
@@ -36,6 +37,8 @@ class CefWindowDelegateView : public views::WidgetDelegateView {
// Initialize the Widget's content.
void InitContent();
void DeleteDelegate();
// WidgetDelegateView methods:
bool CanMaximize() const override { return true; }
View* GetContentsView() override { return this; }
@@ -46,10 +49,12 @@ class CefWindowDelegateView : public views::WidgetDelegateView {
void OnBoundsChanged(const gfx::Rect& previous_bounds) override;
private:
SkColor background_color_;
views::WebView* web_view_;
bool always_on_top_;
const SkColor background_color_;
const bool always_on_top_;
base::RepeatingClosure on_bounds_changed_;
base::OnceClosure on_delete_;
views::WebView* web_view_ = nullptr;
};
#endif // CEF_LIBCEF_BROWSER_NATIVE_WINDOW_DELEGATE_VIEW_H_