[M150] [X11] Guard XDragDropClient and X11Window against destruction during DnD [chromium/src : refs/branch-heads/7871]

0 views

Skip to first unread message

Chromium LUCI CQ (Gerrit)

unread,

Jul 13, 2026, 12:40:36 PM (10 days ago) Jul 13

to chrome-che...@chops-service-accounts.iam.gserviceaccount.com, Thomas Anderson, Sadrul Chowdhury, android-bu...@system.gserviceaccount.com, rubber-...@appspot.gserviceaccount.com, ozone-...@chromium.org

Chromium LUCI CQ submitted the change

Change information

Commit message:

[M150] [X11] Guard XDragDropClient and X11Window against destruction during DnD

Original change's description:
> [X11] Guard XDragDropClient and X11Window against destruction during DnD
>
> X11Window owns XDragDropClient. During drag-and-drop event handling,
> callbacks into target/delegate drop handlers (such as PerformDrop,
> OnBeforeDragLeave, and UpdateDrag) can spin nested run loops. If the
> associated window is closed/destroyed while the nested loop is running,
> both X11Window and XDragDropClient are destroyed.
>
> When the nested loop unwinds, continuing execution in the outer stack
> frames of XDragDropClient and X11Window leads to Use-After-Free (UAF)
> vulnerabilities from raw pointer dereferences and virtual method calls.
>
> This CL fixes the issue by adding base::WeakPtr liveness guards around
> every re-entrant delegate callback in XDragDropClient and X11Window.
>
> Fixed: 532929679
> Change-Id: I5d3e89014993df43cf45db1ff2f1b7825b57ebe5
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8071147
> Reviewed-by: Lei Zhang <the...@chromium.org>
> Commit-Queue: Thomas Anderson <thomasa...@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#1660006}

(cherry picked from commit e4ce9e74fdba5992af9d41349ca3644cfed78c98)