[x11] Fixed UAF in drag and drop.

To short-cut round trips to the X server when drag and drop happens
between two Chromium windows, XDragContext stored the raw pointer to
XDragDropClient of the source window in its source_client_ attribute.
This made possible to access the deleted object (use after free) if the
source window had been destroyed during the operation.  In short,
although the target context can call the source client directly via the
shortcut, the PropertyNotify event comes from the X server (not using
the shortcut), and apparently it can come to the target context after
the source window and its client had been destroyed but before the
target context is notified.  See the issue for full details.

Here the XDragContext::source_client_ is removed, and all its uses
are replaced with getting the client from the global map of clients
[1]. The client removes itself from the map upon destruction [2] so
this change eliminates the vulnerability.

For the record, there is the test in the interactive_ui_tests suite
(namely BookmarkBarViewTest22.CloseSourceBrowserDuringDrag) that should
emulate this situation but is has some flaws [3].

[1] https://source.chromium.org/chromium/chromium/src/+/master:ui/base/x/x11_drag_drop_client.cc;l=120
[2] https://source.chromium.org/chromium/chromium/src/+/master:ui/base/x/x11_drag_drop_client.cc;l=200
[3] https://crbug.com/1106379

Bug: 1153595
Change-Id: Ibb875cb4fa04ddfa8f99b39e4dab654048da86c7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2567229
Reviewed-by: Thomas Anderson <thomasanderson@chromium.org>
Commit-Queue: Alexander Dunaev <adunaev@igalia.com>
Cr-Commit-Position: refs/heads/master@{#833577}
5 files changed
tree: 27920d0694f76c1258dded10ea692b388f7ba287
  1. .clang-format
  2. .clang-tidy
  3. .eslintrc.js
  4. .git-blame-ignore-revs
  5. .gitattributes
  6. .gitignore
  7. .gn
  8. .vpython
  9. .vpython3
  10. .yapfignore
  11. AUTHORS
  12. BUILD.gn
  13. CODE_OF_CONDUCT.md
  14. DEPS
  15. DIR_METADATA
  16. ENG_REVIEW_OWNERS
  17. LICENSE
  18. LICENSE.chromium_os
  19. OWNERS
  20. PRESUBMIT.py
  21. PRESUBMIT_test.py
  22. PRESUBMIT_test_mocks.py
  23. README.md
  24. WATCHLISTS
  25. android_webview/
  26. apps/
  27. ash/
  28. base/
  29. build/
  30. build_overrides/
  31. buildtools/
  32. cc/
  33. chrome/
  34. chromecast/
  35. chromeos/
  36. cloud_print/
  37. codelabs/
  38. codereview.settings
  39. components/
  40. content/
  41. courgette/
  42. crypto/
  43. dbus/
  44. device/
  45. docs/
  46. extensions/
  47. fuchsia/
  48. gin/
  49. google_apis/
  50. google_update/
  51. gpu/
  52. headless/
  53. infra/
  54. ios/
  55. ipc/
  56. jingle/
  57. media/
  58. mojo/
  59. native_client_sdk/
  60. net/
  61. pdf/
  62. ppapi/
  63. printing/
  64. remoting/
  65. rlz/
  66. sandbox/
  67. services/
  68. skia/
  69. sql/
  70. storage/
  71. styleguide/
  72. testing/
  73. third_party/
  74. tools/
  75. ui/
  76. url/
  77. weblayer/
README.md

Logo Chromium

Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web.

The project's web site is https://www.chromium.org.

Documentation in the source is rooted in docs/README.md.

Learn how to Get Around the Chromium Source Code Directory Structure .

For historical reasons, there are some small top level directories. Now the guidance is that new top level directories are for product (e.g. Chrome, Android WebView, Ash). Even if these products have multiple executables, the code should be in subdirectories of the product.