commit 2706470a422dec8f4ae2538e80f0e7e3c4f4f7f6
author Rouslan Solomakhin <rouslan@chromium.org> Fri Dec 14 21:15:33 2018
committer Commit Bot <commit-bot@chromium.org> Fri Dec 14 21:15:33 2018
tree fc2bec12badd270c9c287763936eaa1c62af482c
parent 1429311c4725dba41c4aeef9a9330ce3cd7f02b7

[Payment Request][Desktop] Prevent use after free.

Before this patch, a compromised renderer on desktop could make IPC
methods into Payment Request in an unexpected ordering and cause use
after free in the browser.

This patch will disconnect the IPC pipes if:
 - Init() is called more than once.
 - Any other method is called before Init().
 - Show() is called more than once.
 - Retry(), UpdateWith(), NoupdatedPaymentDetails(), Abort(), or
   Complete() are called before Show().

This patch re-orders the IPC methods in payment_request.cc to match the
order in payment_request.h, which eases verifying correctness of their
error handling.

This patch prints more errors to the developer console, if available, to
improve debuggability by web developers, who rarely check where LOG
prints.

After this patch, unexpected ordering of calls into the Payment Request
IPC from the renderer to the browser on desktop will print an error in
the developer console and disconnect the IPC pipes. The binary might
increase slightly in size because more logs are included in the release
version instead of being stripped at compile time.

Bug: 912947
Change-Id: Iac2131181c64cd49b4e5ec99f4b4a8ae5d8df57a
Reviewed-on: https://chromium-review.googlesource.com/c/1370198
Reviewed-by: anthonyvd <anthonyvd@chromium.org>
Commit-Queue: Rouslan Solomakhin <rouslan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#616822}