diff --git a/patches/chromium/.patches b/patches/chromium/.patches index 7d864b8a165c0..8ce89e81eee37 100644 --- a/patches/chromium/.patches +++ b/patches/chromium/.patches @@ -125,6 +125,8 @@ merge_m86_ensure_that_buffers_used_by_imagedecoder_haven_t_been.patch cherry-pick-2d18de63acf1.patch only_zero_out_cross-origin_audio_that_doesn_t_get_played_out.patch fix_setparentacessibile_crash_win.patch +backport_1142331.patch +backport_1151865.patch cherry-pick-19aeffd4d93f.patch cherry-pick-4794770cf175.patch cherry-pick-79440c3a0675.patch diff --git a/patches/chromium/backport_1142331.patch b/patches/chromium/backport_1142331.patch new file mode 100644 index 0000000000000..1d9bdc3fa52c9 --- /dev/null +++ b/patches/chromium/backport_1142331.patch @@ -0,0 +1,141 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Andrey Belenko +Date: Thu, 10 Dec 2020 18:04:03 +0100 +Subject: Chromium backport: crbug.com/1142331 + +M87-1 +Clipboard: Fix UaP in ClipboardWriter/FileReaderLoader +https://chromium-review.googlesource.com/c/chromium/src/+/2536946 +CVE-2020-16037 + +diff --git a/third_party/blink/renderer/modules/clipboard/clipboard_promise.cc b/third_party/blink/renderer/modules/clipboard/clipboard_promise.cc +index fc5f32d86fd2cc4aeeaadddc94da6ce5e8e7990a..9c72fb55426f685045418947427406016d947589 100644 +--- a/third_party/blink/renderer/modules/clipboard/clipboard_promise.cc ++++ b/third_party/blink/renderer/modules/clipboard/clipboard_promise.cc +@@ -104,7 +104,7 @@ ScriptPromise ClipboardPromise::CreateForWriteText(ExecutionContext* context, + + ClipboardPromise::ClipboardPromise(ExecutionContext* context, + ScriptState* script_state) +- : ExecutionContextClient(context), ++ : ExecutionContextLifecycleObserver(context), + script_state_(script_state), + script_promise_resolver_( + MakeGarbageCollected(script_state)), +@@ -483,13 +483,20 @@ scoped_refptr ClipboardPromise::GetTaskRunner() { + return GetExecutionContext()->GetTaskRunner(TaskType::kUserInteraction); + } + ++// ExecutionContextLifecycleObserver implementation. ++void ClipboardPromise::ContextDestroyed() { ++ script_promise_resolver_->Reject(MakeGarbageCollected( ++ DOMExceptionCode::kNotAllowedError, "Document detached.")); ++ clipboard_writer_.Clear(); ++} ++ + void ClipboardPromise::Trace(Visitor* visitor) const { + visitor->Trace(script_state_); + visitor->Trace(script_promise_resolver_); + visitor->Trace(clipboard_writer_); + visitor->Trace(permission_service_); + visitor->Trace(clipboard_item_data_); +- ExecutionContextClient::Trace(visitor); ++ ExecutionContextLifecycleObserver::Trace(visitor); + } + + } // namespace blink +diff --git a/third_party/blink/renderer/modules/clipboard/clipboard_promise.h b/third_party/blink/renderer/modules/clipboard/clipboard_promise.h +index 18efbc8c632dd7061fb31437529f1b14a25beb3a..307ce3b51a7c75b60301885685f5c0d780997250 100644 +--- a/third_party/blink/renderer/modules/clipboard/clipboard_promise.h ++++ b/third_party/blink/renderer/modules/clipboard/clipboard_promise.h +@@ -26,7 +26,7 @@ class ExecutionContext; + class ClipboardItemOptions; + + class ClipboardPromise final : public GarbageCollected, +- public ExecutionContextClient { ++ public ExecutionContextLifecycleObserver { + USING_GARBAGE_COLLECTED_MIXIN(ClipboardPromise); + + public: +@@ -83,6 +83,9 @@ class ClipboardPromise final : public GarbageCollected, + LocalFrame* GetLocalFrame() const; + scoped_refptr GetTaskRunner(); + ++ // ExecutionContextLifecycleObserver ++ void ContextDestroyed() override; ++ + Member script_state_; + Member script_promise_resolver_; + +diff --git a/third_party/blink/renderer/modules/clipboard/clipboard_writer.cc b/third_party/blink/renderer/modules/clipboard/clipboard_writer.cc +index 2891db58d47b30575efd782ae1c7cf8ee7558cc4..4b224c9679ca51c01328479685970235f35a32fd 100644 +--- a/third_party/blink/renderer/modules/clipboard/clipboard_writer.cc ++++ b/third_party/blink/renderer/modules/clipboard/clipboard_writer.cc +@@ -188,9 +188,12 @@ ClipboardWriter::ClipboardWriter(SystemClipboard* system_clipboard, + file_reading_task_runner_(promise->GetExecutionContext()->GetTaskRunner( + TaskType::kFileReading)), + system_clipboard_(system_clipboard), +- raw_system_clipboard_(raw_system_clipboard) {} ++ raw_system_clipboard_(raw_system_clipboard), ++ self_keep_alive_(PERSISTENT_FROM_HERE, this) {} + +-ClipboardWriter::~ClipboardWriter() = default; ++ClipboardWriter::~ClipboardWriter() { ++ DCHECK(!file_reader_); ++} + + // static + bool ClipboardWriter::IsValidType(const String& type, bool is_raw) { +@@ -220,7 +223,9 @@ void ClipboardWriter::DidFinishLoading() { + DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); + DOMArrayBuffer* array_buffer = file_reader_->ArrayBufferResult(); + DCHECK(array_buffer); ++ + file_reader_.reset(); ++ self_keep_alive_.Clear(); + + worker_pool::PostTask( + FROM_HERE, CrossThreadBindOnce(&ClipboardWriter::DecodeOnBackgroundThread, +@@ -230,6 +235,8 @@ void ClipboardWriter::DidFinishLoading() { + } + + void ClipboardWriter::DidFail(FileErrorCode error_code) { ++ file_reader_.reset(); ++ self_keep_alive_.Clear(); + promise_->RejectFromReadOrDecodeFailure(); + } + +diff --git a/third_party/blink/renderer/modules/clipboard/clipboard_writer.h b/third_party/blink/renderer/modules/clipboard/clipboard_writer.h +index 527b063cd20900653dc37027bef8d24af31fb6de..3de3f5ad34b8ebf378421c64c917e3091e5343c6 100644 +--- a/third_party/blink/renderer/modules/clipboard/clipboard_writer.h ++++ b/third_party/blink/renderer/modules/clipboard/clipboard_writer.h +@@ -9,6 +9,7 @@ + #include "third_party/blink/renderer/core/fileapi/blob.h" + #include "third_party/blink/renderer/core/fileapi/file_reader_loader_client.h" + #include "third_party/blink/renderer/platform/heap/heap.h" ++#include "third_party/blink/renderer/platform/heap/self_keep_alive.h" + #include "third_party/skia/include/core/SkImage.h" + + namespace blink { +@@ -27,6 +28,11 @@ class RawSystemClipboard; + // take advantage of vulnerabilities in their decoders. In + // ClipboardRawDataWriter, this decoding is skipped. + // (3) Writing the blob's decoded contents to the system clipboard. ++// ++// ClipboardWriter is owned only by itself and ClipboardPromise. It keeps ++// itself alive for the duration of FileReaderLoader's async operations using ++// SelfKeepAlive, and keeps itself alive afterwards during cross-thread ++// operations by using WrapCrossThreadPersistent. + class ClipboardWriter : public GarbageCollected, + public FileReaderLoaderClient { + public: +@@ -80,6 +86,10 @@ class ClipboardWriter : public GarbageCollected, + Member system_clipboard_; + // Access to the global unsanitized system clipboard. + Member raw_system_clipboard_; ++ ++ // Oilpan: ClipboardWriter must remain alive until Member::Clear() is ++ // called, to keep the FileReaderLoader alive and avoid unexpected UaPs. ++ SelfKeepAlive self_keep_alive_; + }; + + } // namespace blink diff --git a/patches/chromium/backport_1151865.patch b/patches/chromium/backport_1151865.patch new file mode 100644 index 0000000000000..fac6e8a6765a7 --- /dev/null +++ b/patches/chromium/backport_1151865.patch @@ -0,0 +1,23 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Andrey Belenko +Date: Thu, 10 Dec 2020 22:16:48 +0100 +Subject: Chromium backport: crbug.com/1151865 + +M87-1 +Reject mojom::DataElement serialization if array size read failed +https://chromium-review.googlesource.com/c/chromium/src/+/2567130 +CVE-2020-16041 + +diff --git a/services/network/public/cpp/url_request_mojom_traits.cc b/services/network/public/cpp/url_request_mojom_traits.cc +index ce1478f6df691d5b1f7862a45ac3989a43e2d814..881bcb23ab3291e61088458f46c446fe9e7fb7cf 100644 +--- a/services/network/public/cpp/url_request_mojom_traits.cc ++++ b/services/network/public/cpp/url_request_mojom_traits.cc +@@ -286,6 +286,8 @@ bool StructTraits:: + if (data.type() == network::mojom::DataElementType::kBytes) { + if (!data.ReadBuf(&out->buf_)) + return false; ++ if (data.length() != out->buf_.size()) ++ return false; + } + out->type_ = data.type(); + out->data_pipe_getter_ = data.TakeDataPipeGetter< diff --git a/patches/v8/.patches b/patches/v8/.patches index 6fcf97cad1707..68fc4c01e87a2 100644 --- a/patches/v8/.patches +++ b/patches/v8/.patches @@ -15,6 +15,7 @@ cherry-pick-8c725f7b5bbf.patch cherry-pick-146bd99e762b.patch cherry-pick-633f67caa6d0.patch cherry-pick-290fe9c6e245.patch +backport_1151890.patch cherry-pick-63166010061d.patch merged_deoptimizer_stricter_checks_during_deoptimization.patch merged_compiler_mark_jsstoreinarrayliteral_as_needing_a_frame.patch diff --git a/patches/v8/backport_1151890.patch b/patches/v8/backport_1151890.patch new file mode 100644 index 0000000000000..896e7ba4f44db --- /dev/null +++ b/patches/v8/backport_1151890.patch @@ -0,0 +1,23 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Andrey Belenko +Date: Thu, 10 Dec 2020 22:08:54 +0100 +Subject: Chromium backport: crbug.com/1151890 + +M87-1 +Fix possibly-uninitialized leading digit on right shift +https://chromium-review.googlesource.com/c/v8/v8/+/2565245 +CVE-2020-16042 + +diff --git a/src/objects/bigint.cc b/src/objects/bigint.cc +index 2f8337db979d767dd421b5cf02ded59061ac64f4..d62e4cc00c8459adecaada32599ca25c7d1ad9e4 100644 +--- a/src/objects/bigint.cc ++++ b/src/objects/bigint.cc +@@ -1862,6 +1862,8 @@ Handle MutableBigInt::RightShiftByAbsolute(Isolate* isolate, + DCHECK_LE(result_length, length); + Handle result = New(isolate, result_length).ToHandleChecked(); + if (bits_shift == 0) { ++ // Zero out any overflow digit (see "rounding_can_overflow" above). ++ result->set_digit(result_length - 1, 0); + for (int i = digit_shift; i < length; i++) { + result->set_digit(i - digit_shift, x->digit(i)); + }