commit | 56b10e3c4b3903281e410a0c99955924558d0504 | [log] [tgz] |
---|---|---|
author | Will Harris <wfh@chromium.org> | Mon Oct 09 04:55:34 2017 |
committer | Commit Bot <commit-bot@chromium.org> | Mon Oct 09 04:55:34 2017 |
tree | 621f1d4c9b115f3a6494892dae570d4bc9b96376 | |
parent | a462a3b621d25b2b9475b1b80b4bfc0f13f9a899 [diff] |
Fix out-of-bounds read in sandbox broker. It is unsafe to call GetActualBufferSize if the param count declared by the buffer makes the min_declared_size larger than the buffer size. BUG=772621 Cq-Include-Trybots: master.tryserver.chromium.win:win10_chromium_x64_rel_ng Change-Id: I9d3930230442a055ac27aeafdff52d8b553ec214 Reviewed-on: https://chromium-review.googlesource.com/701283 Reviewed-by: Justin Schuh <jschuh@chromium.org> Commit-Queue: Justin Schuh <jschuh@chromium.org> Cr-Commit-Position: refs/heads/master@{#507329}
Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web.
The project's web site is https://www.chromium.org.
Documentation in the source is rooted in docs/README.md.
Learn how to Get Around the Chromium Source Code Directory Structure .