Skip to content

Commit 0ab0acf

Browse files
Rafal Godlewskimibrunin
authored andcommitted
[Backport] Security bug 431668129
Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/6757109: Check for existence of this in `DialogDelegate::RunCloseCallback` Similarly to https://crrev.com/c/6370014 for the repeated callback variant, widget can get destroyed after running OnceClosure. Since in case of OnceClosure `already_started_close_` is just assigned to true, return it directly after running the callback instead of returning possibly destroyed member at the end. Fixed: 431668129 Change-Id: I6848d351fb3776a82568300d148b4b9189f52078 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6757109 Commit-Queue: Rafał Godlewski <rgod@google.com> Reviewed-by: Keren Zhu <kerenzhu@chromium.org> Cr-Commit-Position: refs/heads/main@{#1487815} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/665028 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
1 parent 9019361 commit 0ab0acf

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

chromium/ui/views/window/dialog_delegate.cc

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -201,12 +201,14 @@ bool DialogDelegate::RunCloseCallback(
201201
if (absl::holds_alternative<base::OnceClosure>(callback)) {
202202
already_started_close_ = true;
203203
absl::get<base::OnceClosure>(std::move(callback)).Run();
204+
return true;
204205
} else {
205206
already_started_close_ =
206207
absl::get<base::RepeatingCallback<bool()>>(callback).Run();
208+
return already_started_close_;
207209
}
208210

209-
return already_started_close_;
211+
NOTREACHED();
210212
}
211213

212214
View* DialogDelegate::GetInitiallyFocusedView() {

0 commit comments

Comments
 (0)