mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1

fix: postMessage crash with invalid transferrable (#46639)

Browse source
This commit is contained in:
Shelley Vohr 2025-04-17 15:09:48 +02:00 • committed by GitHub
parent e8117f8e40
commit 352a403efd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
5 changed files with 82 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

23
shell/browser/api/electron_api_utility_process.cc
View file

@ -330,6 +330,9 @@ void UtilityProcessWrapper::PostMessage(gin::Arguments* args) {
return;
blink::TransferableMessage transferable_message;
gin_helper::ErrorThrower thrower(args->isolate());
// |message| is any value that can be serialized to StructuredClone.
v8::Local<v8::Value> message_value;
if (args->GetNext(&message_value)) {
if (!electron::SerializeV8Value(args->isolate(), message_value,
@ -342,9 +345,25 @@ void UtilityProcessWrapper::PostMessage(gin::Arguments* args) {
v8::Local<v8::Value> transferables;
std::vector<gin::Handle<MessagePort>> wrapped_ports;
if (args->GetNext(&transferables)) {
std::vector<v8::Local<v8::Value>> wrapped_port_values;
if (!gin::ConvertFromV8(args->isolate(), transferables,
&wrapped_port_values)) {
thrower.ThrowTypeError("transferables must be an array of MessagePorts");
return;
}
for (size_t i = 0; i < wrapped_port_values.size(); ++i) {
if (!gin_helper::IsValidWrappable(wrapped_port_values[i],
&MessagePort::kWrapperInfo)) {
thrower.ThrowTypeError(
base::StrCat({"Port at index ", base::NumberToString(i),
" is not a valid port"}));
return;
}
}
if (!gin::ConvertFromV8(args->isolate(), transferables, &wrapped_ports)) {
gin_helper::ErrorThrower(args->isolate())
.ThrowTypeError("Invalid value for transfer");
thrower.ThrowTypeError("Passed an invalid MessagePort");
return;
}
}