Skip to content

Commit fe46d13

Browse files
krockotmibrunin
authored andcommitted
[Backport] Security bug 378917565 (2/2)
Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/6037431: ipcz: Validate introduction transport Gracefully handle (reject) an introduction containing an invalid transport object. This is not really an issue in production since these messages are only accepted from brokers; but the fuzzer can trip over this. Bug: 378917565 Change-Id: I8237bc1ae1da4318fa007bea3c6e6f21a6912b3e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6037431 Reviewed-by: Alex Gough <[email protected]> Commit-Queue: Ken Rockot <[email protected]> Cr-Commit-Position: refs/heads/main@{#1385948} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/624501 Reviewed-by: Anu Aliyas <[email protected]>
1 parent 18b390c commit fe46d13

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

chromium/third_party/ipcz/src/ipcz/node_link.cc

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -459,8 +459,12 @@ bool NodeLink::OnAcceptIntroduction(msg::AcceptIntroduction& accept) {
459459
return false;
460460
}
461461

462-
auto transport = MakeRefCounted<DriverTransport>(
463-
accept.TakeDriverObject(accept.params().transport));
462+
DriverObject transport_object =
463+
accept.TakeDriverObject(accept.params().transport);
464+
if (!transport_object.is_valid()) {
465+
return false;
466+
}
467+
auto transport = MakeRefCounted<DriverTransport>(std::move(transport_object));
464468
node()->AcceptIntroduction(
465469
*this, accept.params().name, accept.params().link_side,
466470
accept.params().remote_node_type, accept.params().remote_protocol_version,

0 commit comments

Comments
 (0)