diff options
| author | Ahmed Fakhry <afakhry@chromium.org> | 2022-01-07 02:27:29 +0000 |
|---|---|---|
| committer | Michael Brüning <michael.bruning@qt.io> | 2022-02-18 01:12:19 +0000 |
| commit | 52c8c403c24b64c332d3ef48d4e2c7d5fecd4516 (patch) | |
| tree | c99ee733555f1b7763577cb7878ac9c83a7b7f56 | |
| parent | 2ac6ece03918c6df6c93fb2a7d842e872cc85bc3 (diff) | |
| download | qtwebengine-chromium-52c8c403c24b64c332d3ef48d4e2c7d5fecd4516.tar.gz | |
[Backport] CVE-2022-0310 and CVE-0311: Heap buffer overflow in Task Manager
Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/3368601:
Fix out-of-bounds crashes in TableView
BUG=1283805, 1283807
TEST=Manual, added a unittest.
Change-Id: I127b7d9683c716ebfc2df4eaa47257785c7786f0
Reviewed-by: Peter Kasting <pkasting@chromium.org>
Reviewed-by: Scott Violet <sky@chromium.org>
Commit-Queue: Ahmed Fakhry <afakhry@chromium.org>
Cr-Commit-Position: refs/heads/main@{#956343}
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
Reviewed-by: Michal Klocek <michal.klocek@qt.io>
| -rw-r--r-- | chromium/ui/views/controls/table/table_view.cc | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/chromium/ui/views/controls/table/table_view.cc b/chromium/ui/views/controls/table/table_view.cc index b9bac9d0965..edfe5ecb846 100644 --- a/chromium/ui/views/controls/table/table_view.cc +++ b/chromium/ui/views/controls/table/table_view.cc @@ -788,7 +788,7 @@ void TableView::OnItemsRemoved(int start, int length) { // Remove the virtual views that are no longer needed. auto& virtual_children = GetViewAccessibility().virtual_children(); - for (int i = start; i < start + length; i++) + for (int i = start; !virtual_children.empty() && i < start + length; i++) virtual_children[virtual_children.size() - 1]->RemoveFromParentView(); UpdateVirtualAccessibilityChildrenBounds(); @@ -1568,7 +1568,11 @@ void TableView::UpdateVirtualAccessibilityChildrenBounds() { // Update the bounds for the table's content rows. for (int row_index = 0; row_index < GetRowCount(); row_index++) { - auto& ax_row = virtual_children[header_ ? row_index + 1 : row_index]; + const size_t ax_row_index = header_ ? row_index + 1 : row_index; + if (ax_row_index >= virtual_children.size()) + break; + + auto& ax_row = virtual_children[ax_row_index]; ui::AXNodeData& row_data = ax_row->GetCustomData(); DCHECK_EQ(row_data.role, ax::mojom::Role::kRow); row_data.relative_bounds.bounds = |