summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Bump V8_PATCH_LEVEL87-basedMichael Brüning2023-05-051-1/+1
| | | | | | | Change-Id: I0cb972a8b9e4d90fcfe562f4b2b2f89de47b6453 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/476096 Reviewed-by: Michal Klocek <michal.klocek@qt.io> Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2023-29469 / Security bug 1433328Michael Brüning2023-05-05138-7212/+6590
| | | | | | | | | | Manual roll of libxml to include cherry-picked security fix. Originally reviewed on: https://chromium-review.googlesource.com/c/chromium/src/+/4457227 Change-Id: If4241792fd07d82d57ecd4b82b928f070a1c43e0 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/475993 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1423360Keren Zhu2023-05-051-0/+7
| | | | | | | | | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4455016: Fix ScopedObservation UaF in BubbleDialogDelegate::AnchorWidgetObserver A ScopedObservation can outlive the aura::Window it observes, leading to a use-after-free error in ~ScopedObservation(). The problem occurs in BubbleDialogDelegate::AnchorWidgetObserver. This fix listens for OnWindowDestroying() and resets the observation to prevent the UaF. Bug: 1423360 Change-Id: I742b4624b2664dea3fd97db7b399fcd15e45c8fe Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4455016 Code-Coverage: Findit <findit-for-me@appspot.gserviceaccount.com> Reviewed-by: Elly Fong-Jones <ellyjones@chromium.org> Commit-Queue: Keren Zhu <kerenzhu@chromium.org> Cr-Commit-Position: refs/heads/main@{#1133511} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/475992 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-2137: Heap buffer overflow in sqliteMichael Brüning2023-05-05308-15475/+81282
| | | | | | | | | | | Manual update of sqlite to version 3.41.2 to get to the same version as reviewed in https://chromium-review.googlesource.com/c/chromium/src/+/4404861. This includes the fix for Chromium bug 1430644 / CVE-2023-2137. Change-Id: I79130f25c34e23ed91c9945bc69737a654b41049 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/475991 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1427388Darius M2023-05-051-1/+2
| | | | | | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/4381738: Merged: [compiler] Prevent constant folding of TypeGuard TypeGuard are used to prevent operations from floating before a preceding check, and thus shouldn't be constant-folded. (cherry picked from commit 867716437273c16dc6ef5bc85b9c18affa1fb242) Fixed: chromium:1427388 Change-Id: Id93807aa7553c6a42b17024b7f7975a1a28fbb78 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4381738 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/branch-heads/11.3@{#6} Cr-Branched-From: b0a3a06aa78a9beb4e8485eb502b20b2abe2abbf-refs/heads/11.3.244@{#1} Cr-Branched-From: 0326cf6343caaa6ea32bb3208e894cb7412e1313-refs/heads/main@{#86647} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/475990 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-2033: Type Confusion in V8Igor Sheludko2023-05-051-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/4422621: Reland "[M108-LTS][runtime] Make Error.captureStackTrace() a no-op for global object" This is a reland of commit 12be50e5ccf198c6353bc82fe0d17e614bfb7431 Original change's description: > [M108-LTS][runtime] Make Error.captureStackTrace() a no-op for global object > > (cherry picked from commit fa81078cca6964def7a3833704e0dba7b05065d8) > > Bug: chromium:1432210 > Change-Id: I8aa4c3f1d9ecbfffce503085c2879416ff916c69 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4417690 > Commit-Queue: Igor Sheludko <ishell@chromium.org> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org> > Auto-Submit: Igor Sheludko <ishell@chromium.org> > Cr-Original-Commit-Position: refs/heads/main@{#87045} > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4422621 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Cr-Commit-Position: refs/branch-heads/10.8@{#52} > Cr-Branched-From: f1bc03fd6b4c201abd9f0fd9d51fb989150f97b9-refs/heads/10.8.168@{#1} > Cr-Branched-From: 237de893e1c0a0628a57d0f5797483d3add7f005-refs/heads/main@{#83672} Bug: chromium:1432210 No-Try: true No-Presubmit: true No-Tree-Checks: true Change-Id: I4c06a76db005a61b2259b836c1f06c78eb004e16 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4459252 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Cr-Commit-Position: refs/branch-heads/10.8@{#56} Cr-Branched-From: f1bc03fd6b4c201abd9f0fd9d51fb989150f97b9-refs/heads/10.8.168@{#1} Cr-Branched-From: 237de893e1c0a0628a57d0f5797483d3add7f005-refs/heads/main@{#83672} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/475989 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1811: Use after free in FramesDave Tapuska2023-05-051-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4372837: [M108-LTS] Move the edit commands to an on stack variable DevTools uses nested event loops and the usage of the class member can be problematic for iteration because the nested loop can change the variable's storage causing a UAF. (cherry picked from commit d9b34f0f3a2d0dd73648eca3ef940fb66806227b) Bug: 1420510 Change-Id: Ie08a71b60401fa4322cca0cc31062ba64672126a Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4355811 Commit-Queue: Dave Tapuska <dtapuska@chromium.org> Reviewed-by: Daniel Cheng <dcheng@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1120123} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4372837 Reviewed-by: Dave Tapuska <dtapuska@chromium.org> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Cr-Commit-Position: refs/branch-heads/5359@{#1435} Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/475988 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1810: Heap buffer overflow in Visualskylechar2023-05-052-9/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4298330: Add CHECKs in HostFrameSinkManager It looks like it's possible for a compromised renderer to get multiple things to register the same FrameSinkId with HostFrameSinkManager. This violates assumptions around ownership so turn DCHECKs here into CHECKs. Also convert DCHECKs into CHECKs for registering/unregistering frame sink hierarchy just in case. (cherry picked from commit a707ac2d95e4726f4cf0267c9b0c038926c2a691) Bug: 1414018 Change-Id: If948e758a8484024666f4066360620bc3a9cb493 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4283141 Reviewed-by: Martin Kreichgauer <martinkr@google.com> Reviewed-by: Jonathan Ross <jonross@chromium.org> Commit-Queue: Kyle Charbonneau <kylechar@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1109533} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4298330 Cr-Commit-Position: refs/branch-heads/5615@{#69} Cr-Branched-From: 9c6408ef696e83a9936b82bbead3d41c93c82ee4-refs/heads/main@{#1109224} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/475987 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1530: Use after free in PDF (2/2)Tom Sepez2023-04-141-0/+19
| | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://pdfium-review.googlesource.com/c/pdfium/+/104511: More tightly validate XML names in CXFA_FFDocView::GetWidgetByName() Widget names must conform to XML name rules. -- Beef up tests while at it. Fixed: chromium:1419831 Change-Id: Id36b4a7b3d84aa0b74d54c91eed2f1a11da8298f Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/104511 Reviewed-by: Lei Zhang <thestig@chromium.org> Commit-Queue: Tom Sepez <tsepez@chromium.org> Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/469852 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* Fixes for building with GCC-13Martin Negyokru2023-04-1432-1/+41
| | | | | | | | | | Fixes: QTBUG-111697 Change-Id: I51fca3b3eb627b2617ff5c6c051fa1182671244d Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/464490 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io> (cherry picked from commit 9de0d8a90d9b0176542db8b54d678a9fcbb69337) Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468198 Reviewed-by: Christophe Marin <christophe@krop.fr>
* [Backport] CVE-2023-1530: Use after free in PDF (1/2)Tom Sepez2023-04-043-20/+34
| | | | | | | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://pdfium-review.googlesource.com/c/pdfium/+/104397: Observe CPWL_* object destruction across CPDFSDK_Widget methods This is a simple fix to stop the symptoms while we investigate how to avoid mutations at these points in the first place. -- fix some nearby braces and annoying blank lines while at it. Bug: chromium:1419831 Change-Id: I20c38806b91c7c0c9016bb1b567a04ce319243d8 Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/104397 Commit-Queue: Tom Sepez <tsepez@chromium.org> Reviewed-by: Lei Zhang <thestig@chromium.org> Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/469851 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1531: Use after free in ANGLEGeoff Lang2023-04-042-2/+67
| | | | | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on xhttps://chromium-review.googlesource.com/c/angle/angle/+/4348337: M112: D3D11: Add logic to disassociate EGL image storages. The TextureStorage classes for External and EGLImages were missing the logic to disassociate from images. This lead to the images continuing to hold references to deleted storages. Bug: chromium:1415330 Change-Id: I8303f6751d87a9b0a52993c7d4e9509b086b93f3 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/4328347 Reviewed-by: Peng Huang <penghuang@chromium.org> Commit-Queue: Geoff Lang <geofflang@chromium.org> (cherry picked from commit a8720455fda43167465c3d2f9a13fca60c21f56e) Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/4348337 Reviewed-by: Shahbaz Youssefi <syoussefi@chromium.org> Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/469850 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1418734Peter Boström2023-04-041-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Partial manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4288168: Convert known it != end() DCHECK failures to CHECK M102 merge issues: third_party/blink/renderer/core/annotation/annotation_agent_impl.cc is not present in 102 These have hit on DCHECK builds in the wild and precede erasing or dereferencing an iterator that is UB. This CL excludes DCHECK failures that precede non-DCHECK handling of the it != end() failures. Those should probably be rewritten as CHECKs but are less urgent and semi-orthogonal. Known crashes (one per file) are: crash/dc49e3cadab36d4c crash/0ee3427d25937024 crash/b89303e84d123019 crash/cc35183b861a4992 Bug: 1418734 Change-Id: I81ed7b45be33769e250c65c8bb7334a34be4380e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4288168 Commit-Queue: Peter Boström <pbos@chromium.org> Cr-Commit-Position: refs/heads/main@{#1109350} (cherry picked from commit 1aec0b297900a7b59bd24314dff239f3c5697f45) Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468621 Reviewed-by: Michal Klocek <michal.klocek@qt.io> Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/469849
* [Backport] Security bug 1417585Tobias Tebbi2023-04-042-1/+22
| | | | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/4296133: Merged: [compiler] check if maps become deprecated during optimization Bug: chromium:1417585 (cherry picked from commit f82d802a20aa62e42269f977302f26c5c3ed031b) Change-Id: Icdb0065ab6042fb2833bc63a741e78d59f937763 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4296133 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/branch-heads/11.1@{#24} Cr-Branched-From: c77793a2ee5bfa7c5226dd8f622bf331b97a5a25-refs/heads/11.1.277@{#1} Cr-Branched-From: 95b79bf04ba3f9de87f7bad77bc2d7552e5dc4d7-refs/heads/main@{#85479} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/469848 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1337747Danil Somsikov2023-04-041-1/+1
| | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/4184203: Fix error dispatch in the v8 inspector session. Bug: chromium:1337747 Change-Id: I920f3c6370ac9f9bc351eff34e46b1e8d520fe3e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4184203 Auto-Submit: Danil Somsikov <dsv@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/main@{#85449} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/469847 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1534: Out of bounds read in ANGLEGeoff Lang2023-04-041-0/+5
| | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4324998: Disable glShaderBinary in the passthrough cmd decoder. This matches the behaviour of the validating command decoder. The client does not use this function and it's not exposed to WebGL. Bug: 1422594 Change-Id: I87c670e4e80b0078fddb9f089b7ac7777a6debfa Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4324998 Commit-Queue: Geoff Lang <geofflang@chromium.org> Cr-Commit-Position: refs/heads/main@{#1115379} (cherry picked from commit 4a81311a62d853a43e002f45c6867f73c0accdab) Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/469846 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1529: Out of bounds memory access in WebHIDMatt Reynolds2023-04-041-5/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4320692: hid: Handle empty input reports It's possible for a HID device to define its report descriptor such that one or more reports have no data fields within the report. When receiving these reports, the report buffer should contain only the report ID byte and no other data. Ensure that we do not read past the end of the buffer when handling zero-length input reports. (cherry picked from commit c9d77da78bc66c135520ac77873d67b89cdcaee6) Bug: 1419718 Change-Id: I51d32c20f6b16f0d2b0172e0a165469b6b79748c Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4296562 Commit-Queue: Matt Reynolds <mattreynolds@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1112009} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4320692 Commit-Queue: Reilly Grant <reillyg@chromium.org> Auto-Submit: Matt Reynolds <mattreynolds@chromium.org> Cr-Commit-Position: refs/branch-heads/5481@{#1341} Cr-Branched-From: 130f3e4d850f4bc7387cfb8d08aa993d288a67a9-refs/heads/main@{#1084008} (cherry picked from commit b041159d06adbf7487639bd33a261cc0270d7a34) Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/469845 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1222: Heap buffer overflow in Web Audio APIHongchan Choi2023-04-047-10/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | Manual backport of patch originallt reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4150813: Handle a transitory state of context/destination correctly for AudioWorklet operation When the context resumes from a suspended state, it is possible for the internal (destination) and the external (context) state to be different in a rare case. This allows the non-worklet thread to touch the worklet-related objects, which can causes invalid access to the V8-managed memory space. This CL adds a check; if the context state is suspended it swaps the task runner right away without waiting until a resume() promise is resolved. Bug: 1403515 Test: The provided repro case doesn't crash ASAN anymore. Change-Id: Ic2ea7b0337c444b7dc7d9d8b7195ed3e9ac3955f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4150813 Reviewed-by: Michael Wilson <mjwilson@chromium.org> Commit-Queue: Hongchan Choi <hongchan@chromium.org> Cr-Commit-Position: refs/heads/main@{#1096948} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/469844 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1220: Heap buffer overflow in UMAWill Harris2023-04-041-0/+6
| | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4289351: Fix potential out of bounds write in base::SampleVectorBase BUG=1417185 (cherry picked from commit 552939b035e724e022fedb90fd80cd008e441fcf) Change-Id: I70719d0f9afb81dda373f88ab3a1c177397659ec Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4265437 Commit-Queue: Will Harris <wfh@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1106984} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4289351 Commit-Queue: Zakhar Voit <voit@google.com> Reviewed-by: Victor-Gabriel Savu <vsavu@google.com> Owners-Override: Victor-Gabriel Savu <vsavu@google.com> Cr-Commit-Position: refs/branch-heads/5359@{#1397} Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/469843 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1219: Heap buffer overflow in Metrics (3/3)Will Harris2023-04-041-2/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4280124: Prevent potential integer overflow in PersistentMemoryAllocator https://crrev.com/c/4250177 added an extra check for potential integer overflow in GetAllocSize but forgot to add the same check in GetBlock. This meant that it was possible to get a pointer to a block but calling GetAllocSize on the same block would return zero. This change makes the two functions consistent with each other so calling GetBlock on invalid data will return nullptr. BUG=1417317,1415328 (cherry picked from commit 81be8e8f2e13a9f1fe6d3150205a3c13af1db6e9) Change-Id: I8eb3d91bae4528fc97517d202baf337536a4c81f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4264177 Commit-Queue: Alexei Svitkine <asvitkine@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1107105} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4280124 Owners-Override: Victor-Gabriel Savu <vsavu@google.com> Reviewed-by: Victor-Gabriel Savu <vsavu@google.com> Commit-Queue: Zakhar Voit <voit@google.com> Cr-Commit-Position: refs/branch-heads/5359@{#1402} Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/469842 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1219: Heap buffer overflow in Metrics (2/3)Will Harris2023-04-043-12/+0
| | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4279942: Do not register browser_watcher activity report with crashpad BUG=1415328 (cherry picked from commit f93c88303ccbb64014a575b8ae093aa166832922) Change-Id: I109f6dac083a69a26841ee5e975e02093ca4cbf6 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4257669 Commit-Queue: Will Harris <wfh@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1106253} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4279942 Reviewed-by: Victor-Gabriel Savu <vsavu@google.com> Commit-Queue: Zakhar Voit <voit@google.com> Owners-Override: Victor-Gabriel Savu <vsavu@google.com> Cr-Commit-Position: refs/branch-heads/5359@{#1401} Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/469841 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1219: Heap buffer overflow in Metrics (1/3)Will Harris2023-04-041-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4279513: Prevent potential integer overflow in PersistentMemoryAllocator BUG=1415328 (cherry picked from commit 19de280a0c28065acf2a7e001af5c981698a461c) Change-Id: I66dcae6a1aacc1310ddd715033b3704c932b9800 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4250177 Commit-Queue: Will Harris <wfh@chromium.org> Commit-Queue: Alexei Svitkine <asvitkine@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1105177} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4279513 Commit-Queue: Zakhar Voit <voit@google.com> Owners-Override: Victor-Gabriel Savu <vsavu@google.com> Reviewed-by: Victor-Gabriel Savu <vsavu@google.com> Cr-Commit-Position: refs/branch-heads/5359@{#1400} Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/469840 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1217: Stack buffer overflow in Crash reportingRobert Sesek2023-04-041-1/+7
| | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/crashpad/crashpad/+/4284559: win: Only process up to EXCEPTION_MAXIMUM_PARAMETERS in an EXCEPTION_RECORD The EXCEPTION_RECORD contains a NumberParameters field, which could store a value that exceeds the amount of space allocated for the ExceptionInformation array. Bug: chromium:1412658 Change-Id: Ibfed8eb6317e28d3addf9215cda7fffc32e1030d Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/4284559 Reviewed-by: Alex Gough <ajgo@chromium.org> Commit-Queue: Robert Sesek <rsesek@chromium.org> Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/469839 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-1215: Type Confusion in CSSSteinar H. Gunderson2023-04-041-0/+11
| | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4307470: In Typed CSSOM, reject adding to something that is not a list. M102 merge issues: third_party/blink/renderer/core/css/cssom/style_property_map.cc: The check before the added IsValueList check isn't present in 102 Fixed: 1417176 Change-Id: Idef1a81af46d334c181979778c28f19ce6369718 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4293477 Commit-Queue: Steinar H Gunderson <sesse@chromium.org> Cr-Commit-Position: refs/heads/main@{#1110281} (cherry picked from commit 7301cf1e40fdd97594ea491676b867cf4e577edc) Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/469818 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-0933: Integer overflow in PDFLei Zhang2023-02-271-3/+14
| | | | | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://pdfium-review.googlesource.com/c/pdfium/+/103078: Validate the page count. In CountPages(), which recursively calls itself, validate the page count. When any part of the pages tree contains bad data, bail out. Bug: chromium:1404864 Change-Id: Ifdbc14213ec3f963b4b2cb5793b83c15d03336e8 Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/103078 Reviewed-by: Tom Sepez <tsepez@chromium.org> Commit-Queue: Lei Zhang <thestig@chromium.org> Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/462800 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-0931: Use after free in Video (2/2)Dale Curtis2023-02-274-64/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4225497: [M102-LTS] Further simplify WebMediaPlayerMSCompositor lifetime. M102 merge issues: third_party/blink/renderer/modules/mediastream/webmediaplayer_ms.cc: - video_task_runner_ is named io_task_runner_ in 102 - Conflicting arguments for CrossThreadBindOnce in ActivateSurfaceLayerForVideo() third_party/blink/renderer/modules/mediastream/webmediaplayer_ms_compositor.cc: - The use_surface_layer check is different in 102 - video_task_runner_ is named io_task_runner_ in 102 (conflict in ReplaceCurrentFrameWithACopy) Due to the raw pointer held by VideoFrameSubmitter, there may be tasks pending on the compositor task runner after the RefCounted traits have "destructed" WebMediaPlayerMSCompositor. Through this raw pointer VFS was invoking OnContextLost which attempts to use the zero ref count compositor. The solution here is again similar to VideoFrameCompositor, its destruction should be explicit instead of a tangle of RefCounted owners. (cherry picked from commit 1622bffc6534a0cc4f53d07c43e0cd8f49975d10) Fixed: 1407701, 1411601 Change-Id: Ic77294d1113d54ab83bc0f5b625a997edf57bf7c Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4210508 Commit-Queue: Tony Herre <toprice@chromium.org> Auto-Submit: Dale Curtis <dalecurtis@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1099726} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4225497 Reviewed-by: Michael Ershov <miersh@google.com> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Owners-Override: Michael Ershov <miersh@google.com> Cr-Commit-Position: refs/branch-heads/5005@{#1436} Cr-Branched-From: 5b4d9450fee01f821b6400e947b3839727643a71-refs/heads/main@{#992738} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/462799 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-0931: Use after free in Video (1/2)Dale Curtis2023-02-273-30/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4227731: [M102-LTS] Simplify WebMediaPlayerMSCompositor destruction. The code was only sometimes calling StopUsingProvider() and posted the submitter destruction unnecessarily. Destruction now works the same as in VideoFrameCompositor, where the class itself is responsible for calling StopUsingProvider() during its own destruction. (cherry picked from commit cbd238e85903b7d94910bd2c6362ff9abf9908cc) Fixed: 1407701 Change-Id: Ia649cb5532519468eea34e12745ed9c990580d82 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4195824 Auto-Submit: Dale Curtis <dalecurtis@chromium.org> Commit-Queue: Tony Herre <toprice@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1098505} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4227731 Owners-Override: Michael Ershov <miersh@google.com> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Reviewed-by: Michael Ershov <miersh@google.com> Cr-Commit-Position: refs/branch-heads/5005@{#1435} Cr-Branched-From: 5b4d9450fee01f821b6400e947b3839727643a71-refs/heads/main@{#992738} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/462798 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* FIXUP: Mark Node::opcode() and Operator::opcode() as constexpr.Peter Varga2023-02-252-2/+8
| | | | | | | | Ignore constexpr for GCC 7 or older to make LinuxRHEL CI happy. Change-Id: I6784350b16732640d9bd1d41b7403b5059f16737 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/462765 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Add checksum to mailbox name in Release build tooPeter Varga2023-02-231-1/+1
| | | | | | | | | | | | | The lack of checksum may cause assert and error messages when a mailbox is passed from a release render process to a debug render process. Task-number: QTBUG-110504 Change-Id: Ib7d78e1e86a3f2ddda6dc8066abf9198040c38f6 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/461554 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io> (cherry picked from commit f10c0c429f688fa7ee39ca8af4ff522e30776bea) Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/462335 Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
* [Backport][Windows] Remove unused sidestep intercepts.Peter Varga2023-02-2313-2624/+14
| | | | | | | | | | | | | This CL removes the unused sidestep intercepts and associated code. The code was never ported to 64-bit and isn't used in 32-bit builds. Task-number: QTBUG-108240 Bug: 1270309 Review-URL: https://chromium-review.googlesource.com/c/chromium/src/+/3324867 Cr-Commit-Position: refs/heads/main@{#950447} Change-Id: Ib0e97a593b2218a6d93a99e16a55ff34f8607a61 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/462007 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Mark Node::opcode() and Operator::opcode() as constexpr.Peter Varga2023-02-232-2/+2
| | | | | | | | | | | | Without the explicit constexpr keyword, Clang seems to be able to treat these methods as constexpr, whereas MSVC will not. Bug: v8:11760 Review-URL: https://chromium-review.googlesource.com/c/v8/v8/+/2912916 Cr-Commit-Position: refs/heads/master@{#74791} Change-Id: I75a9bdf0fa455940f8703988438e99ffc6b3be8b Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/462017 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2023-0698: Out of bounds read in WebRTCRoger Zanoni2023-02-201-9/+10
| | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://webrtc-review.googlesource.com/c/src/+/291109: Handle the case of missing certificates. M102 merge issues: No conflict but needed to reset the author of this commit to be able to upload it. Original author: Henrik Boström <hbos@webrtc.org> Certificates being missing is a sign of a bug (e.g. webrtc:14844, to be fixed separately) which is why we have a DCHECK. But this DCHECK does not protect against accessing the invalid iterator if it is a release build. This CL makes that safe. Bug: chromium:1408392 Change-Id: I97a82786028e41c58ef8ef15002c3f959bbec7f1 Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/291109 Commit-Queue: Henrik Boström <hbos@webrtc.org> Cr-Commit-Position: refs/heads/main@{#39159} (cherry picked from commit 124d7c3fe5bdc79a355c9df02d07f25331631a68) Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/461410 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2023-0472: Use after free in WebRTCHarald Alvestrand2023-02-202-6/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4176412: Delete PeerConnectionHandler in PeerConnection finalizer Also guard against removal of PC during PeerConnectionHandler call that may cause garbage collection. (cherry picked from commit 5066dd66309d884762e5fb9be04b59582893d09a) Bug: chromium:1405256 Change-Id: I9adf7b219e2026e07ccc0868c1a85f3b35cd9d26 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4154578 Commit-Queue: Harald Alvestrand <hta@chromium.org> Reviewed-by: Guido Urdaneta <guidou@chromium.org> Commit-Queue: Guido Urdaneta <guidou@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1091801} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4176412 Auto-Submit: Harald Alvestrand <hta@chromium.org> Cr-Commit-Position: refs/branch-heads/5359@{#1347} Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/456883 Reviewed-by: Michal Klocek <michal.klocek@qt.io> Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/461409 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Security bug 1406115Vasiliy Telezhnikov2023-02-201-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4178714 Remove NUM_COMMAND_BUFFER_NAMESPACES from SyncToken.mojom Mojo validates input for allowed values, NUM_COMMAND_BUFFER_NAMESPACES is not valid value to send over ipc and is used only to know maximum value in code. (cherry picked from commit d652130c4bc2842d5df5488c69ef4f3168634a54) Bug: 1406115 Change-Id: I8e5c3b6b2a9a9206fbeb377b27ceb1242a4f54e2 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4167409 Reviewed-by: danakj <danakj@chromium.org> Commit-Queue: Vasiliy Telezhnikov <vasilyt@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1093100} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4178714 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/branch-heads/5359@{#1352} Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/456881 Reviewed-by: Michal Klocek <michal.klocek@qt.io> Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/461408 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Add missing include for std::begin and std::end in SkParseColor.cppPeter Varga2023-02-151-0/+3
| | | | | | | Change-Id: I8b7db87b750f8eaf8a466d53177e19d65fa034a8 Review-URL: https://skia-review.googlesource.com/c/skia/+/533981 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/460367 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Fix more clang deprecated builtinsPeter Varga2023-02-011-0/+2
| | | | | | | | | | | | | | | | | If you compile with clang 15+, the uses of trivially destructible and assignable are deprecated. This sets this configuration correctly as the ifdef to fix the build. Fixes https://github.com/abseil/abseil-cpp/issues/1201 Related https://github.com/abseil/abseil-cpp/pull/1277 Original Pull Request: https://github.com/abseil/abseil-cpp/pull/1289 Task-number: QTBUG-108240 Change-Id: Id5456e3da01e16e9370f9fa6ed279360e1df523d Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/455716 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Disable ABSL_HAVE_STD_IS_TRIVIALLY_ASSIGNABLE for clang-cl.Peter Varga2023-02-011-1/+1
| | | | | | | | | | | | | | | | | | | The Lexan and MSVC toolchains both set _MSC_VER. The MSVC toolchain must set `ABSL_HAVE_STD_IS_TRIVIALLY_ASSIGNABLE` and `ABSL_HAVE_STD_IS_TRIVIALLY_CONSTRUCTIBLE`, in order to use Abseil workarounds in the absence of these types. This is not necessary for clang-cl. This change excludes clang-cl from the predicate setting these variables. Original commit: https://github.com/abseil/abseil-cpp/commit/0c92330442d6b1be934e0407115c8084250ef347 Task-number: QTBUG-108240 Change-Id: I591cec6326a4a2a9d800ee067dcc9f0a8629ecb7 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/455715 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Map the absl::is_trivially_* functions to their std implPeter Varga2023-02-013-0/+35
| | | | | | | | | | | | | | | There's no point redefining these functions if they are supported by the compiler and the version of libstdc++. Also, some of the builtins used by the absl implementation of these functions (e.g. __has_trivial_destructor) have been deprecated in Clang 15. Original commit: https://github.com/abseil/abseil-cpp/commit/cfe27e79cfcbefb2b4479e04f80cbb299bc46965 Task-number: QTBUG-108240 Change-Id: I7373b65d84909b2e1877b78ff9058446ab5720e4 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/455714 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* FIXUP: Fixes for building with MSVCPeter Varga2023-01-311-0/+1
| | | | | | | Task-number: QTBUG-108240 Change-Id: Ic8f328c0dff9b7ef2d21d378278c9bf3008ddf2b Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/455717 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Revert "[Backport] Security bug 1395604"Michael Brüning2023-01-231-16/+1
| | | | | | | | | | It is not applicable on this branch. This reverts commit 83f89843310c5e690b6fa01faf67bca409669cbd. Change-Id: I8a8bd6084a8d7168416ee80d53a1aeea8e1813cf Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/455569 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1393384Marco Paniconi2023-01-202-2/+13
| | | | | | | | | | | | | | | | | | | Manual backport of patch originally submitted on https://aomedia-review.googlesource.com/c/aom/+/167662: rtc: Avoid scene detection on resize Don't enter scene detection under external resize. Add rc->prev_coded_width/height to track the previous encoded frame eweight/height. The rc is part of layer context so this will be per spatial layer for SVC. This fixes the buffer overflow issue below. Bug: chromium:1393384 Change-Id: I4b11818a27c439c2d2c42036dff7b8777f70a86e Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/450082 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1399424Clemens Backes2023-01-201-4/+15
| | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/4102800: Do not emit the constant pool before a branch After computing the branch offset but before emitting the actual branch, we should not emit a constant pool. Otherwise the previously computed offset would be off. Instead of handling this indirectly via the Assembler::branch_offset method, do this directly in the Assembler::b method (and friends), so it is not missed on other call sites. R=​jkummerow@chromium.org Bug: chromium:1399424 Change-Id: I0cbb219ced5b671001a296b1cc7c339f395abffe Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4102800 Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#84828} (cherry picked from commit 9be597d194e108ba718610b9a611fe19a0fbfde5) Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/454384 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Security bug 1395604Clemens Backes2023-01-201-1/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/4111948: Load 32-bit values more efficiently When loading a 32-bit value from the stack, just load 32 bit and zero-extend them into the target register, instead of loading the full 64 bits. As there are things to fix (see https://crbug.com/1356461), we only enable this optimization for Wasm for now. R=​jkummerow@chromium.org (cherry picked from commit a38209949fcbf045231c316e2d790b8b70ccb7ef) Bug: chromium:1395604 No-Try: true No-Presubmit: true No-Tree-Checks: true Change-Id: Ibdd2d80704973362906aec9b38faa762d3b43f3f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4097424 Cr-Original-Commit-Position: refs/heads/main@{#84796} Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4111948 Reviewed-by: Maya Lekova <mslekova@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Cr-Commit-Position: refs/branch-heads/10.2@{#45} Cr-Branched-From: 374091f382e88095694c1283cbdc2acddc1b1417-refs/heads/10.2.154@{#1} Cr-Branched-From: f0c353f6315eeb2212ba52478983a3b3af07b5b1-refs/heads/main@{#79976} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/454383 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2023-0129: Heap buffer overflow in Network ServiceMaks Orlovich2023-01-203-5/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4048289: Align NetworkContext::SetNetworkConditions better with devtools emulateNetworkConditions The former used values of 0 to disable particular throttles, while the later documents -1, and looks to be pretty much a direct client, and the only one. So make NetworkService handle everything <= 0 as a disable, clamping at intake of config. Bug: 1382033 (cherry picked from commit ce463c2c939818a12bbcec5e2c91c35f2a0a1f0e) Change-Id: I2fd3f075d5071cb0cf647838782115b5c00405bf Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4035891 Reviewed-by: Ken Buchanan <kenrb@chromium.org> Reviewed-by: Eric Orth <ericorth@chromium.org> Commit-Queue: Maks Orlovich <morlovich@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1073566} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4048289 Cr-Commit-Position: refs/branch-heads/5414@{#188} Cr-Branched-From: 4417ee59d7bf6df7a9c9ea28f7722d2ee6203413-refs/heads/main@{#1070088} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/454382 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Drop dependency on content/public/browser in content gpuMichal Klocek2023-01-194-10/+12
| | | | | | | | | | | | | | | We include header from content/public/browser which includes generated headers, however we do not have that dependency on content gpu. This creates build race condition as generated headers might to be in place. Unfortunately adding that dependency causes some gn asserts, as this dependency should not be allowed. Therefore, move GetInProcessGpuShareGroup from browser content to gpu content, where it make more sense. Pick-to: 102-based 108-based Change-Id: I9dfc37ddf7466ca7b431a31b379e811583790467 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/455058 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] Security bug 1394382Michael Brüning2023-01-12119-7760/+6547
| | | | | | | | | Manually update libxml to the version 2.9.13 and the sha1 used on 102-based. Change-Id: I699696b395258a6ba3a1a9b2f48d10036f2b638f Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/450083 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-4437: Use after free in Mojo IPCKen Rockot2023-01-101-1/+4
| | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4066994: Mojo: Fix potential UAF in IPC Channel Fixed: 1394692 Change-Id: I1753b79eb6e9230ebb663eca47295d81dd859068 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4066994 Commit-Queue: Ken Rockot <rockot@google.com> Cr-Commit-Position: refs/heads/main@{#1077742} (cherry picked from commit 120b4b05ac7eaa9024f677394aa663c2702174ce) Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/450080 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-4438: Use after free in Blink FramesJaroslav Sevcik2023-01-061-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4055626: Make WidgetBase::BeginMainFrame resilient to disposed 'this' This patch makes sure that WidgetBase::BeginMainFrame can finish execution even if processing the RAF-throttled handlers (DispatchRafAlignedInput) destroys 'this' instance. (cherry picked from commit af6e22c14bec7ad64115b24ece6d423f144214ca) Bug: chromium:1381871 Change-Id: I81aa4ba697f80f8666bb2a3b5542cac210b1efa9 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4030809 Reviewed-by: Dave Tapuska <dtapuska@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1072864} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4055626 Auto-Submit: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/branch-heads/5414@{#279} Cr-Branched-From: 4417ee59d7bf6df7a9c9ea28f7722d2ee6203413-refs/heads/main@{#1070088} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/450081 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2022-4179: Use after free in AudioZakhar Voit2022-12-223-10/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4024547: Replace raw pointer to LocalMuter with weak ptr This CL replaces a raw pointer to LocalMuter with a weak ptr. Additional info about this bug here: http://crbug/1377783 (cherry picked from commit 9989b93eb12c93b9351d5bf2872c1069ef5f7d01) Bug: 1377783 Change-Id: Id821ea800ba12f1cfae4677fc591c12dec112852 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3997421 Commit-Queue: Evan Liu <evliu@google.com> Cr-Original-Commit-Position: refs/heads/main@{#1068776} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4024547 Auto-Submit: Evan Liu <evliu@google.com> Owners-Override: Srinivas Sista <srinivassista@chromium.org> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Reviewed-by: Evan Liu <evliu@google.com> Cr-Commit-Position: refs/branch-heads/5359@{#824} Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933} (cherry picked from commit 65d46507a0c9e88b407060d0b8b7d9f0897d09e2) Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/446484 Reviewed-by: Michal Klocek <michal.klocek@qt.io> Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/450108
* Fixup for patch for CVE-2022-3200 on OpenSuse 15.1Michael Brüning2022-12-091-3/+5
| | | | | | | | The code was using an intialization not supported by the compiler. Change-Id: I0b92b161672464025cb67196929f3da4701f3f88 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/447781 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
View Lorry Controller Status