Google Git
Sign in
chromium / chromium / src / a4c579c9a8e4e05f3b3ec012c40cb36c6ae89e11
commita4c579c9a8e4e05f3b3ec012c40cb36c6ae89e11[log] [tgz]
authorGastón Rodríguez <gastonr@microsoft.com>Fri Jul 25 16:08:49 2025
committerChromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com>Fri Jul 25 16:08:49 2025
treebdd4973c343052e1897c3aa965b3dca15a7bd0ee
parent3f1c9f3196f590dafeb54d9a14e6c8f292814218 [diff]
Make DesktopDragDropClientWin a Window observer to avoid UAF

If the renderer process crashes while a drag and drop is happening, the
Window object for the source_window in
DesktopDragDropClientWin::StartDragAndDrop will be freed. When the drag
and drop is finished, the function will try to access the freed object,
causing a use after free exception.

This CL fixes this issue by temporarily adding the drag and drop client
as an observer of the Window. The Window will notify it's observers when
it's being destroyed, and with this we can avoid accessing the freed
object.

I was able to reproduce the crash following the steps in the linked
bug, and stopped observing after the changes in this CL were
implemented.

Bug: 432497641
Change-Id: Ic05aadcd9005c9f5eb8b660a7d5a182b859e62eb
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6779234
Reviewed-by: David Bienvenu <davidbienvenu@chromium.org>
Reviewed-by: Robert Liao <robliao@chromium.org>
Commit-Queue: Gaston Rodriguez <gastonr@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#1492096}
1 file changed
tree: bdd4973c343052e1897c3aa965b3dca15a7bd0ee
  1. .github/
  2. agents/
  3. android_webview/
  4. apps/
  5. ash/
  6. base/
  7. build/
  8. build_overrides/
  9. buildtools/
  10. cc/
  11. chrome/
  12. chromecast/
  13. chromeos/
  14. codelabs/
  15. components/
  16. content/
  17. crypto/
  18. dbus/
  19. device/
  20. docs/
  21. extensions/
  22. fuchsia_web/
  23. gin/
  24. google_apis/
  25. gpu/
  26. headless/
  27. infra/
  28. ios/
  29. ipc/
  30. media/
  31. mojo/
  32. net/
  33. pdf/
  34. printing/
  35. remoting/
  36. rlz/
  37. sandbox/
  38. services/
  39. skia/
  40. sql/
  41. storage/
  42. styleguide/
  43. testing/
  44. third_party/
  45. tools/
  46. ui/
  47. url/
  48. webkit/
  49. clank
  50. clusterfuzz-data
  51. internal
  52. ios_internal
  53. signing_keys
  54. v8
  55. .clang-format
  56. .clang-tidy
  57. .clangd
  58. .cursorignore
  59. .git-blame-ignore-revs
  60. .gitallowed
  61. .gitattributes
  62. .gitignore
  63. .gitmodules
  64. .gn
  65. .mailmap
  66. .rustfmt.toml
  67. .vpython3
  68. .yapfignore
  69. ATL_OWNERS
  70. AUTHORS
  71. BUILD.gn
  72. CODE_OF_CONDUCT.md
  73. codereview.settings
  74. CPPLINT.cfg
  75. CRYPTO_OWNERS
  76. DEPS
  77. DIR_METADATA
  78. LICENSE
  79. LICENSE.chromium_os
  80. OWNERS
  81. PRESUBMIT.py
  82. PRESUBMIT_test.py
  83. PRESUBMIT_test_mocks.py
  84. README.md
  85. SECURITY_OWNERS
  86. WATCHLISTS
README.md

Logo Chromium

Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web.

The project's web site is https://www.chromium.org.

To check out the source code locally, don't use git clone! Instead, follow the instructions on how to get the code.

Documentation in the source is rooted in docs/README.md.

Learn how to Get Around the Chromium Source Code Directory Structure.

For historical reasons, there are some small top level directories. Now the guidance is that new top level directories are for product (e.g. Chrome, Android WebView, Ash). Even if these products have multiple executables, the code should be in subdirectories of the product.

If you found a bug, please file it at https://crbug.com/new.