Skip to content

Commit 4fe7f50

Browse files
szager-chromiummibrunin
authored andcommitted
[Backport] CVE-2024-12694: Use after free in Compositing
Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/6093379: Prevent ImageData from being reclaimed while in use Cherry-picked from: https://chromium-review.googlesource.com/c/chromium/src/+/5990752 Bug: chromium:368222741 Change-Id: If830b19287fd7c4aa07137044f23a14f8ce6912d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6093379 Reviewed-by: Prudhvikumar Bommana <[email protected]> Owners-Override: Prudhvikumar Bommana <[email protected]> Commit-Queue: Prudhvikumar Bommana <[email protected]> Cr-Commit-Position: refs/branch-heads/6723@{#2713} Cr-Branched-From: 985f2961df230630f9cbd75bd6fe463009855a11-refs/heads/main@{#1356013} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/615319 Reviewed-by: Anu Aliyas <[email protected]>
1 parent fabc804 commit 4fe7f50

File tree

1 file changed

+9
-0
lines changed

1 file changed

+9
-0
lines changed

chromium/cc/tiles/gpu_image_decode_cache.cc

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2401,6 +2401,9 @@ void GpuImageDecodeCache::DecodeImageIfNecessary(
24012401

24022402
image_data->decode.ResetData();
24032403

2404+
// Prevent image_data from being deleted while lock is not held.
2405+
scoped_refptr<ImageData> image_data_holder(image_data);
2406+
24042407
// Decode the image into `aux_image_data` while the lock is not held.
24052408
DecodedAuxImageData aux_image_data[kAuxImageCount];
24062409
{
@@ -2728,6 +2731,9 @@ void GpuImageDecodeCache::UploadImageIfNecessary_GpuCpu_YUVA(
27282731
sk_sp<SkImage> uploaded_v_image =
27292732
image_data->decode.image(2, AuxImage::kDefault);
27302733

2734+
// Prevent image_data from being deleted while lock is not held.
2735+
scoped_refptr<ImageData> image_data_holder(image_data);
2736+
27312737
// For kGpu, we upload and color convert (if necessary).
27322738
if (image_data->mode == DecodedDataMode::kGpu) {
27332739
DCHECK(!use_transfer_cache_);
@@ -2815,6 +2821,9 @@ void GpuImageDecodeCache::UploadImageIfNecessary_GpuCpu_RGBA(
28152821
DCHECK(!use_transfer_cache_);
28162822
DCHECK(!image_data->info.yuva.has_value());
28172823

2824+
// Prevent image_data from being deleted while lock is not held.
2825+
scoped_refptr<ImageData> image_data_holder(image_data);
2826+
28182827
// RGBX decoding is below.
28192828
// For kGpu, we upload and color convert (if necessary).
28202829
if (image_data->mode == DecodedDataMode::kGpu) {

0 commit comments

Comments
 (0)