summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix heap overflow when allocating PowerSaveBlockerMichal Klocek2018-12-212-2/+11
| | | | | | | | | | We are missing build flag when compilng wake lock, which creates missmach in PowerSaveBlocer class size. Done-With: Kirill Burtsev<kirill.burtsev@qt.io> Change-Id: Id27c1a5da34c92961d614f54feae1858ffcb6e1d Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io> Reviewed-by: Kirill Burtsev <kirill.burtsev@qt.io>
* [Backport] Fix use-after-scope on reference temporary detected by ASanReid Kleckner2018-12-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Consider this code: const String& attribute_value = AtomicString(html_attribute.second); It gets a String member, creates a temporaty AtomicString, and then returns a reference to its String member. The AtomicString object is not lifetime extended. However, if we change the type of the variable to 'const AtomicString&', then it will be lifetime extended, and there is no bug. This is causing the Linux and Windows ASan ToT bots to time out, so I will TBR this. TBR=csharrison@chromium.org BUG=869067 Change-Id: Ie90c7f07038c4d394b8cba5d03fec4569476ed91 Reviewed-on: https://chromium-review.googlesource.com/1155832 Reviewed-by: Reid Kleckner <rnk@chromium.org> Commit-Queue: Reid Kleckner <rnk@chromium.org> Cr-Commit-Position: refs/heads/master@{#579244} Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Minor. Remove old src version of sqliteMichal Klocek2018-12-20588-476475/+0
| | | | | | | | | Remove old sqlite source code to avoid future misreference (src is using currently sqlite-src-3250200) Task-number: QTBUG-72632 Change-Id: I0300f4ff1b458d4e35e5eb01cc10603fbcc042f8 Reviewed-by: Kai Koehne <kai.koehne@qt.io>
* [Backport] Update SQLite / Security bug 900910Michal Klocek2018-12-20135-11147/+25662
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | sqlite: Upgrade to the 3.25.3 code in M72. This CL pulls //third_party/sqlite from M72. The original sources in //third_party/sqlite/sqlite-src-* were not changed, to avoid making the diff even bigger than it already is. This CL also pulls changes to //sql and //third_party/blink from the following commits that landed in M72: c6d3a866083891cf6cd935091ea877fa507d14a2 9a6c08e6e8436b8e1bae14a736a5db684287f939 The changes above are needed by the SQLite upgrade. Tested: full debug build (compilation errors in tests were in unrelated files), ran browser_tests, content_unittests, sql_unittests and the LayoutTests in storage/websql/ TBR=cmumford Bug: 900910 Reviewed-on: https://chromium-review.googlesource.com/c/1352694 Task-number: QTBUG-72632 Change-Id: I562b92883101d9cdfba89a28295d1b176ad48138 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] Prepare for sqllite updateMichal Klocek2018-12-203-26/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | sqlite: Clean up build. This CL includes the following inter-dependent changes. 1) Use SQLITE_DEFAULT_LOOKASIDE instead of a sqlite_db_config() call. 2) Use SQLITE_OMIT_COMPILEOPTION_DIAGS. This is needed to avoid a compilation error after the previous change. 3) Rework the way Chome-specific defines are injected into the SQLite amalgamation. This is needed to get the code linking after the previous change, and is explained in detail below. 4) Replace Chromium -> Chrome in SQLite's BUILD.gn file. While the project's name is Chromium, the codebase refers to the resulting product as Chrome. This is not strongly related to the above, but is bundled to avoid merge conflicts. Chrome's SQLite version is first generated using the standard amalgamation process [1]. Then we inject a set of macros [2] adding a prefix to every symbol exported by SQLite. This is currently done by taking advantage of the fact that a standard build of SQLite #includes a "config.h" header if the _HAVE_SQLITE_CONFIG_H macro is defined. Our current approach relies on the fact that the amalgamation generation script simply happens to list ctime.c as the first file in the amalgamation [3]. When the file's content is ignored by defining the SQLITE_OMIT_COMPILEOPTION_DIAGS macro, the assumption does not hold anymore. This CL replaces the _HAVE_SQLITE_CONFIG_H macro with an approach guaranteed to surive changes in SQLite's amalgamation process. Instead of building amalgamation/sqlite3.c directly, this CL introduces a sqlite3_shim.c which sets up the Chrome-specific compilation environment, including our rename macros, and then #includes amalgamation/sqlite3.c. [1] https://www.sqlite.org/amalgamation.html [2] https://cs.chromium.org/chromium/src/third_party/sqlite/amalgamation/rename_exports.h [3] https://cs.chromium.org/chromium/src/third_party/sqlite/src/tool/mksqlite3c.tcl?q=ctime.c Reviewed-on: https://chromium-review.googlesource.com/1146155 Task-number: QTBUG-72632 Change-Id: I98eed50b0bbe0560e46f37d3aae85ad62572db0a Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] Security bug 877843Michal Klocek2018-12-195-16/+83
| | | | | | | | | | | | | Avoid overflow when parsing H.264 SPS. Check that |log2_max_frame_num_minus4| and |log2_max_pic_order_cnt_lsb_minus4| are at most 28, resulting in a field width of at most 32 bits. Bug: chromium:877843 Reviewed-on: https://webrtc-review.googlesource.com/101760 Change-Id: I684f92b8f0f2fcdbab24732d8e8381bc51a92752 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] Security bug 892643Michal Klocek2018-12-192-1/+6
| | | | | | | | | | | | | | | | | | | | | | fonts: Fix nullptr de-reference during fallback path search. R=herb@google.com Bug: 892643 Reviewed-on: https://skia-review.googlesource.com/c/160834 ------------------------------------------------------------- Don't allow 4GB font mapped memory allocations The mapped memory allocator only supports unsigned int, so don't allow arbitrary size_t allocations through. This seems like a pretty reasonable limit anyway. Bug: 892643 Reviewed-on: https://chromium-review.googlesource.com/c/1271577 Change-Id: I871f5fc78c5d979605d0a075dc632ac94575b695 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] Security bug 839250Michal Klocek2018-12-193-27/+66
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Keep ClipboardHostImpl from shooting itself in the foot On Linux, reading the clipboard requires running a nested message loop. Since it's undesirable to wait infinitely long, the X11 clipboard code sets a timer to bail out. Unfortunately, this timer relies on running a nestable task, which means IPCs can be re-entrantly processed, e.g. with a call stack like: // running more IPC tasks here base::RunLoop::Run() ui::SelectionRequestor::BlockTillSelectionNotifyForRequest() ui::SelectionRequestor::PerformBlockingConvertSelection() ui::ClipboardAuraX11::AuraX11Details::WaitAndGetTargetsList() ui::ClipboardAuraX11::IsFormatAvailable() content::ClipboardHostImpl::ReadText() // mojo here Since ClipboardHostImpl is bound with mojo::StrongBinding, a connection error (once seen) will synchronously delete ClipboardHostImpl. This means a hostile endpoint can cause ClipboardHostImpl to self-delete while it's on the stack. Oops. The "fix" is to post a non-nestable task to delete ClipboardHostImpl to prevent a footgun injury. Bug: 839250 Reviewed-on: https://chromium-review.googlesource.com/c/1266204 Change-Id: I76b15dba4d8a5262495c297a2e7f0f33e220e7c2 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* Add extensions to Qt build and fix it up for buildingMichael Brüning2018-12-1917-13/+186
| | | | | | | | | | Jumbo patch that includes all the patches needed to enable the extension system for the Qt build. Currently used for conveniently moving the code around, but may become the actual change to get it merged upstream. Change-Id: Ie1920b31f9bbf40c8753cada2716d7f9fcb39280 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Security bug 880665Michael Brüning2018-12-199-128/+135
| | | | | | | | | | | | | | | MidiManager: Fix a potential race on macOS CompleteInitialization can be posted at a place after DeleteSoon's task, and it can potentially cause a UAF crash. This happens only on browser's shutdown sequence, and it won't practically. But just in case and to make ASAN bots happy:) Bug: 880665, 672793 Change-Id: I64b26f1009d8446f61092d8e17a22f45777c62ef Reviewed-on: https://chromium-review.googlesource.com/1238297 Cr-Commit-Position: refs/heads/master@{#594667} Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 879965Michal Klocek2018-12-187-10/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prevent renderer initiated back navigation to cancel a browser one. Renderer initiated back/forward navigations must not be able to cancel ongoing browser initiated navigation if they are not user initiated. Note: 'normal' renderer initiated navigation uses the FrameHost::BeginNavigation() path. A code similar to this patch is done in NavigatorImpl::OnBeginNavigation(). Test: ----- Added: NavigationBrowserTest. * HistoryBackInBeforeUnload * HistoryBackInBeforeUnloadAfterSetTimeout * HistoryBackCancelPendingNavigationNoUserGesture * HistoryBackCancelPendingNavigationUserGesture Fixed: * (WPT) .../the-history-interface/traverse_the_history_2.html * (WPT) .../the-history-interface/traverse_the_history_3.html * (WPT) .../the-history-interface/traverse_the_history_4.html * (WPT) .../the-history-interface/traverse_the_history_5.html Bug: 879965 Reviewed-on: https://chromium-review.googlesource.com/1209744 Change-Id: I8f5da6b2048b761362de6514f1f9e31d0465db0f Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] Security bug 882270Michal Klocek2018-12-181-0/+11
| | | | | | | | | | | | | | | | | Abort navigations on 304 responses. A recent change (https://chromium-review.googlesource.com/1161479) accidentally resulted in treating 304 responses as downloads. This CL treats them as ERR_ABORTED instead. This doesn't exactly match old behavior, which passed them on to the renderer, which then aborted them. The new code results in correctly restoring the original URL in the omnibox, and has a shiny new test to prevent future regressions. Bug: 882270 Reviewed-on: https://chromium-review.googlesource.com/1252684 Change-Id: Id0cfb899064b29c7c4d761d0d638f28af4e0fe35 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] Security bug 895885Michal Klocek2018-12-182-3/+13
| | | | | | | | | | | | | | Map U+0909 and U+0993 to 3 when checking for confusables U+0909 (उ) and U+0993 (ও) look similar to the number 3. Thic cl adds these two characters to the mapping to 3 when determining whether to fall back to punycode when displaying URLs. Bug: 895885 Reviewed-on: https://chromium-review.googlesource.com/c/1287031 Reviewed-on: https://chromium-review.googlesource.com/c/1307846 Change-Id: I87bdccb1f06b7cae2260ce633f39aa75fcc16332 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backpack] CVE-2018-18359Michal Klocek2018-12-182-3/+25
| | | | | | | | | | | | | | | | | Merged: Fix Reflect.construct with constructors without a prototype slot Revision: 7a3cb59fadb6e8fcdc00b25e31ee21adf07538d5 BUG=chromium:907714 LOG=N NOTRY=true NOPRESUBMIT=true NOTREECHECKS=true R=verwaest@chromium.org Reviewed-on: https://chromium-review.googlesource.com/c/1356513 Change-Id: Id79c1ca70639deacbf1ec1c1ea7b521558a14195 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] CVE-2018-18358Michal Klocek2018-12-189-9/+268
| | | | | | | | | | | | | | Bypass proxy for localhost and link-local addresses when using PAC scripts. This is a partial cherry-pick of da790f920bbc169a6805a4fb83b4c2ab09532d91 to M71. Whereas the change on trunk applies the policy uniformly to both manual and automatic proxy settings, this version limits the implicit bypasses to PAC scripts. Bug: 899126 Reviewed-on: https://chromium-review.googlesource.com/c/1324880 Change-Id: I4ff52cafbd77dfec4523da01657b699616bae4e2 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] CVE-2018-18357Michal Klocek2018-12-182-5/+11
| | | | | | | | | | | | | | Map U+10DE to 3 when checking for confusables Georgian letter U+10DE (პ) looks similar to the number 3. This cl adds U+10DE to the mapping to 3 when determining whether to fall back to punycode when displaying URLs. Bug: 895207 Change-Id: I49bd8905df27a348f35954ae690cfe80b44d29ff Reviewed-on: https://chromium-review.googlesource.com/c/1284396 Reviewed-on: https://chromium-review.googlesource.com/c/1307844 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] CVE-2018-18356Michal Klocek2018-12-183-3/+8
| | | | | | | | | | be consistent about int for incReserve Bug: 883666 Reviewed-on: https://skia-review.googlesource.com/c/162620 Reviewed-on: https://skia-review.googlesource.com/c/170347 Change-Id: I83c62b21fec187d89926d0f8d4a670849b433c4a Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] CVE-2018-18355Michal Klocek2018-12-181-0/+4
| | | | | | | | | | | | Block modifier-letter-voicing character from domain names This character (ˬ) is easy to miss between other characters. It's one of the three characters from Spacing-Modifier-Letters block that ICU lists in its recommended set in uspoof.cpp. Two of these characters (modifier-letter-turned-comma and modifier-letter-apostrophe) are already blocked in crbug/678812. Bug: 896717 Reviewed-on: https://chromium-review.googlesource.com/c/1303037 Reviewed-on: https://chromium-review.googlesource.com/c/1318544 Change-Id: Ic9eb6e831d40e6b96c6626d7dc6f1089abe806d7 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] CVE-2018-18350Michal Klocek2018-12-186-21/+56
| | | | | | | | | | | | Inherit CSP when self-navigating to local-scheme URL As the linked bug example shows, we should inherit CSP when we navigate to a local-scheme URL (even if we are in a main browsing context). Bug: 799747 Reviewed-on: https://chromium-review.googlesource.com/c/1234337 Change-Id: I48969bdee11d1947faa6f1c7d8e1bc1fc3c380bc Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] CVE-2018-18349Michal Klocek2018-12-181-0/+8
| | | | | | | | | | | | | | | | | | | | | | | Merge to M71: Add a check for disallowing remote frame navigations to local resources. Previously, RemoteFrame navigations did not perform any renderer-side checks and relied solely on the browser-side logic to block disallowed navigations via mechanisms like FilterURL. This means that blocked remote frame navigations were silently navigated to about:blank without any console error message. This CL adds a CanDisplay check to the remote navigation path to match an equivalent check done for local frame navigations. This way, the renderer can consistently block disallowed navigations in both cases and output an error message. TBR=alexmos@chromium.org Bug: 894399 Reviewed-on: https://chromium-review.googlesource.com/c/1282390 Reviewed-on: https://chromium-review.googlesource.com/c/1315531 Change-Id: Idd9a074d3e1f6bb099c011c3d3dbc2eb351ba68d Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] CVE-2018-18347Michal Klocek2018-12-181-2/+7
| | | | | | | | | | | | Don't preserve NavigationEntry for failed navigations with invalid URLs. The formatting logic may rewrite such URLs into an unsafe state. This is a first step before preventing navigations to invalid URLs entirely. Bug: 850824 Reviewed-on: https://chromium-review.googlesource.com/c/1252942 Change-Id: Ibe4d9dedaa0232d18f8dbaa93c41f008518d0fb3 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] CVE-2018-18345Michal Klocek2018-12-182-9/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | Lock down blob/filesystem URL creation with a stronger CPSP::CanCommitURL() ChildProcessSecurityPolicy::CanCommitURL() is a security check that's supposed to tell whether a given renderer process is allowed to commit a given URL. It is currently used to validate (1) blob and filesystem URL creation, and (2) Origin headers. Currently, it has scheme-based checks that disallow things like web renderers creating blob/filesystem URLs in chrome-extension: origins, but it cannot stop one web origin from creating those URLs for another origin. This CL locks down its use for (1) to also consult CanAccessDataForOrigin(). With site isolation, this will check origin locks and ensure that foo.com cannot create blob/filesystem URLs for other origins. For now, this CL does not provide the same enforcements for (2), Origin header validation, which has additional constraints that need to be solved first (see https://crbug.com/515309). Bug: 886976, 888001 Reviewed-on: https://chromium-review.googlesource.com/1235343 Change-Id: I7f784240ff7a0295e03f786317e8f227e0fceceb Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] CVE-2018-18343Michal Klocek2018-12-182-18/+171
| | | | | | | | | | | | | | | | | | | | Bug: 882423 allow path.add(path) safely Reviewed-on: https://skia-review.googlesource.com/153260 -------------------------------------------------------- Expand SkPath fuzzer Reviewed-on: https://skia-review.googlesource.com/153889 -------------------------------------------------------- Fix SkPath::reverseAddPath and fuzzing of SkPath enums Reviewed-on: https://skia-review.googlesource.com/154300 Change-Id: Ifc6540e71ea82d8ff829cdeb636e504e65e2c90d Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] CVE-2018-18342Michal Klocek2018-12-181-0/+3
| | | | | | | | | | | | | | | | | Merged: Only expect new data properties in ValueDeserializer. Revision: 2603bb051e9b31802419a47bff03bb8ec7bb0641 TBR=hablich@chromium.org BUG=chromium:906313 LOG=N NOTRY=true NOPRESUBMIT=true NOTREECHECKS=true Reviewed-on: https://chromium-review.googlesource.com/c/1346118 Change-Id: Ie0e552e7bc3c95367dd5bfe5327e9aa6f6470e38 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] CVE-2018-18341Michal Klocek2018-12-182-2/+20
| | | | | | | | | | | | Add bounds CHECK to UTF-8 decoder memory allocation. Avoid integer overflow when computing a total buffer size from a base buffer and small partial sequence buffer. Bug: 901030 Reviewed-on: https://chromium-review.googlesource.com/c/1313833 Change-Id: I8bad75bb2c8af114520fc56767d2f76b8f8d8e2f Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] CVE-2018-18340Michal Klocek2018-12-183-2/+27
| | | | | | | | | Check context is attached before creating MediaRecorder Bug: 896736 Reviewed-on: https://chromium-review.googlesource.com/c/1324231 Change-Id: Icf94a8fcb928577b874a8f67e0a670dee8d2bf09 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] CVE-2018-18339Michal Klocek2018-12-182-34/+34
| | | | | | | | | | | | | | | | | | | Use ref counting for automatic nodes in DeferredTaskHandler Previously the storage for automatic pull nodes (handlers actually) were using a raw pointer, so when the BaseAudioContext goes away there\ is no object keeping these node alive. This CL adds ref-counting to the storage so the handler can be alive even after BaseAudioContext is swept away. Without this fix, the crash happens in few minutes. Bug: 891187 Test: The repro case does not crash after 2 hours on the local ASAN. Reviewed-on: https://chromium-review.googlesource.com/c/1286823 Change-Id: I5207f5123efe0321aea8d12dc780c09abe68e9e1 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] CVE-2018-18338Michal Klocek2018-12-184-26/+55
| | | | | | | | | | | | | | | Fix *StaticBitmapImage ThreadChecker and unaccelerated SkImage destroy - AcceleratedStaticBitmapImage was misusing ThreadChecker by having its own detach logic. Using proper DetachThread is simpler, cleaner and correct. - UnacceleratedStaticBitmapImage didn't destroy the SkImage in the proper thread, leading to GrContext/SkSp problems. Bug: 890576 Reviewed-on: https://chromium-review.googlesource.com/c/1307775 Change-Id: I36d0ecb09b96a6b5e037881cce0fd248dde80ba6 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] CVE-2018-18337Michal Klocek2018-12-181-2/+3
| | | | | | | | | | | | | | | Avoid crash when setting rel=stylesheet on <link> in shadow root. Link elements in shadow roots without rel=stylesheet are currently not added as stylesheet candidates upon insertion. This causes a crash if rel=stylesheet is set (and then loaded) later. R=futhark@chromium.org Bug: 886753 Reviewed-on: https://chromium-review.googlesource.com/1242463 Change-Id: I5d8ad344910e12bc1575db13158f965a47387ddf Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] CVE-2018-18335Michal Klocek2018-12-181-3/+8
| | | | | | | | | | | | | | | | Validate allocation size in GrBufferAllocPool using SkSafeMath. Bug: 895362 Cherry pick to M71 No-Tree-Checks: true No-Try: true No-Presubmit: true Reviewed-On: https://skia-review.googlesource.com/c/163485 Reviewed-on: https://skia-review.googlesource.com/c/170349 Change-Id: I5927ee1c1b8e221f47451d00c02f0de6354d6c4e Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] CVE-2018-17481Tom Sepez2018-12-184-15/+53
| | | | | | | | | | | | | Merge M71: Make public IndirectObjectHolder orphan tracking feature Original CL at https://pdfium-review.googlesource.com/c/45111 Manual merge to avoid conflicts. Bug: chromium:901654 Reviewed-on: https://pdfium-review.googlesource.com/c/45330 Change-Id: Ifdad31c5ef15b5d2479c571d43b00bd3edbca5e3 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] CVE-2018-18336Michal Klocek2018-12-1814-67/+91
| | | | | | | | | | | | | Fix CPLW_Wnd ownership model in CFFL_FormFiller. CFFL_FormFiller::DestroyPDFWindow() might get re-entered, so do not leave any dangling references in maps. Use unique_ptr to be more sure that we have it right. Bug: chromium:898531 Reviewed-on: https://pdfium-review.googlesource.com/c/44542 Change-Id: I01f2986c6082760b3d73f5326dab9d6f0017a5ea Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] Security bug 851821Michal Klocek2018-12-189-14/+96
| | | | | | | | | | | | | | | | | | | | | | | | Reland "Make potentially dangerous Actions require a user click." This is a reland of 9d784c291714b703b16185e69860a3797de85b6c https://chromium-review.googlesource.com/c/chromium/src/+/1244367 was submitted changing the test that broke with this CL to not depend on PDF OpenActions anymore. Original change's description: > Make potentially dangerous Actions require a user click. > > URI and SubmitForm actions are only handled if the event was > ButtonUp or ButtonDown. > > Bug: 851821 > Reviewed-on: https://pdfium-review.googlesource.com/42731 Bug: 851821 Reviewed-on: https://pdfium-review.googlesource.com/43410 Change-Id: I562a651b544e459105812343ab0a1aefa63b66b1 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] CVE-2018-17480Michal Klocek2018-12-181-4/+16
| | | | | | | | | | | | | | | | | Merged: Check array element length in ValueDeserializer Revision: 206b8e0851093e61cf22dc2af3f103df9f2de9b3 NOTRY=true NOPRESUBMIT=true NOTREECHECKS=true TBR=verwaest@chromium.org Bug: chromium:905940 Reviewed-on: https://chromium-review.googlesource.com/c/1340243 Change-Id: I9913edfbff1022d8f68041d53928f58230224580 Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* Fix building gn on armAllan Sandfeld Jensen2018-12-112-0/+173
| | | | | | | | Two arm header files were missing. Change-Id: I3d9cd03c682b9de6b38e75085bcda9deef81b5fa Fixes: QTBUG-72393 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* Fix x86-32 builds with GCC 8Allan Sandfeld Jensen2018-12-101-3/+3
| | | | | | | | | The C++11 alignof() now returns minimum alignment and not prefered alignment which Chromium expects. Change-Id: I7aadb426e6e15b4f2317cafdde550ea74e4c1ccf Fixes: QTBUG-72391 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* FIXUP: Pass virtual url of data url request back to the UIAllan Sandfeld Jensen2018-11-291-1/+2
| | | | | | | | Only set virtual_url when it was a based on a load data request, otherwise we will get wrong data for error pages. Change-Id: Ie59b60de66990aa23016264e63b5dfdcd5198404 Reviewed-by: Alexandru Croitor <alexandru.croitor@qt.io>
* FIXUP: Switch to use glx over ozoneAllan Sandfeld Jensen2018-11-291-3/+5
| | | | | | | Still make GetXDisplay available for optional X11 services Change-Id: I5c3091b20fae076fb731a887d512f5174eeb11a2 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Fix of CVE-2018-17479 (2/2)Allan Sandfeld Jensen2018-11-241-8/+22
| | | | | | | | | | | | | | Harden gpu::SizedResult against overflow Use CheckedNumerics to prevent silent uint32_t overflow. Bug: 905336, 905459 Change-Id: Ie518def9063143ef2393be566419a209f68f0dce Reviewed-on: https://chromium-review.googlesource.com/c/1336520 Reviewed-by: Antoine Labour <piman@chromium.org> Cr-Commit-Position: refs/branch-heads/3538@{#1090} Cr-Branched-From: 79f7c91a2b2a2932cd447fa6f865cb6662fa8fa6-refs/heads/master@{#587811} Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* [Backport] Fix of CVE-2018-17479 (1/2)Allan Sandfeld Jensen2018-11-241-11/+13
| | | | | | | | | | | | | | | | | | | | | | gpu: fix GetResultAs callsites GetResultAs returns a pointer to the transfer buffer. Under some conditions, the transfer buffer may be reallocated, so we need to make sure a GetResultAs-returned pointer isn't used across such a reallocation. Bug: 905336 Change-Id: I1a9699d38149c56ee5430bff125a1168ca053696 Reviewed-on: https://chromium-review.googlesource.com/c/1336152 Commit-Queue: Antoine Labour <piman@chromium.org> Reviewed-by: James Darpinian <jdarpinian@chromium.org> Reviewed-by: Kenneth Russell <kbr@chromium.org> Cr-Original-Commit-Position: refs/heads/master@{#608145}(cherry picked from commit 0d836853c4944a4afc507be85613b998476898fc) Reviewed-on: https://chromium-review.googlesource.com/c/1336518 Reviewed-by: Antoine Labour <piman@chromium.org> Cr-Commit-Position: refs/branch-heads/3538@{#1089} Cr-Branched-From: 79f7c91a2b2a2932cd447fa6f865cb6662fa8fa6-refs/heads/master@{#587811} Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* Fix bogus check for thumb in zlibMichal Klocek2018-11-231-2/+2
| | | | | | | | | For arm64 there is aarch64 instruction so no point in checking for thumb. Change-Id: I2899b52d84a8648c8aaf019cf3a0df96caeca3a1 Reviewed-by: Peter Varga <pvarga@inf.u-szeged.hu> Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* FIXUP: Pass virtual url of data url request back to the UIAllan Sandfeld Jensen2018-11-221-4/+13
| | | | | | | | | | Pass the virtual URL as the requested URL during same-document history navigation, and never set virtual URL if it mathes the primary URL. Fixes: QTBUG-71762 Change-Id: I411903bf7501e60048c88141346259f2a436f2a3 Reviewed-by: Jüri Valdmann <juri.valdmann@qt.io>
* Add net::URLRequest::first_party_url()Tamas Zakor2018-11-218-0/+54
| | | | | | | | | Returns the top level frame URL. Used instead of site_for_cookies() in case of cross-origin iframe navigations. Task-number: QTBUG-70790 Change-Id: Icec4beddd70b20120d53e17a35385d83d1276ac2 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Fix idle detection with X11 OzoneAllan Sandfeld Jensen2018-11-213-15/+16
| | | | | | | Only depend on use_xscrnsaver, not on using the X11 backend. Change-Id: I64d63332d98cd83fcaf47515a3e8048aac22c737 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* Fix compiling zlib without thumbMichal Klocek2018-11-151-1/+1
| | | | | Change-Id: I5548b5a8ae351ae872e02441d869b3cd7bc5d426 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Fix building skcms with intel ccAllan Sandfeld Jensen2018-11-141-2/+2
| | | | | Change-Id: I25a4e5185566a542e909971c8479cc053ac457a1 Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
* Fix assert in V8 mksnapshot when building on macOSv5.12.0-rc2v5.12.0-rc1v5.12.0Alexandru Croitor2018-11-131-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The "assert" keyword seemed to be a typescript construct from the ported patch, and it caused a crash while building: /usr/bin/python chromium/v8/tools/run.py ./mksnapshot --turbo_instruction_scheduling --embedded_src gen/v8/embedded.cc --embedded_variant Default --random-seed 314159265 --startup_src gen/v8/snapshot.cc FAILED: gen/v8/embedded.cc gen/v8/snapshot.cc /usr/bin/python ../../../../../qt512_source/qtwebengine/src/3rdparty/chromium/v8/tools/run.py ./mksnapshot --turbo_instruction_scheduling --embedded_src gen/v8/embedded.cc --embedded_variant Default --random-seed 314159265 --startup_src gen/v8/snapshot.cc # Fatal error in # ../../../../../qt512_source/qtwebengine/src/3rdparty/chromium/v8/src/ast/ast-value-factory.h, # line 75 # Debug check failed: has_string_. # #FailureMessage Object: 0x7ffeef8da3b0 ==== C stack trace =============================== 0 mksnapshot 0x0000000100ffb393 v8::base::debug::StackTrace::StackTrace() + 19 1 mksnapshot 0x0000000100ffec99 v8::platform::(anonymous namespace)::PrintStackTrace() + 41 2 mksnapshot 0x0000000100ff5465 V8_Fatal(char const*, int, char const*, ...) + 325 3 mksnapshot 0x0000000100ff4fd5 v8::base::(anonymous namespace)::DefaultDcheckHandler(char const*, int, char const*) + 21 4 mksnapshot 0x0000000100364b05 v8::internal::AstRawString::string() const + 85 Remove the line for now. Amends c2aeb1c6d21cd952be6b2c1ed765e4c5f0b2d340. Change-Id: I0c89f71df00734a15f33159d2a11e7403c89bfcf Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Fix for CVE-2018-17478Allan Sandfeld Jensen2018-11-132-1/+12
| | | | | | | | | | | | | | | | | | | | | | | Merged: [array] Ensure PrepareElementsForSort returns a legal value PrepareElementsForSort must return a number less than or equal the array length. No-Try: true No-Presubmit: true No-Treechecks: true Bug: chromium:897512, v8:7382 Change-Id: If5f9c4d052e623ab9f3300b8534603abbee859fa Reviewed-on: https://chromium-review.googlesource.com/c/1297958 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Cr-Original-Commit-Position: refs/heads/master@{#56982} Reviewed-on: https://chromium-review.googlesource.com/c/1304354 Reviewed-by: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/branch-heads/7.0@{#67} Cr-Branched-From: 6e2adae6f7f8e891cfd01f3280482b20590427a6-refs/heads/7.0.276@{#1} Cr-Branched-From: bc08a8624cbbea7a2d30071472bc73ad9544eadf-refs/heads/master@{#55424} Reviewed-by: Michael Brüning <michael.bruning@qt.io>
* Make sure we do not use png for host buildMichal Klocek2018-11-131-0/+2
| | | | | | | | Adds assert. Task-number: QTBUG-68090 Change-Id: I7aa153df99002ecd7b28081f2cfdb6b768cdcc49 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Do not make tools for webkit layout testsMichal Klocek2018-11-091-1/+1
| | | | | | | | | This drops requirement for png being needed by host tools (imagediff). Task-number: QTBUG-68090 Change-Id: Ib11c37c7404a66fe9455433676d6fd80222604c0 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
View Lorry Controller Status