hans@, I see you involved in libflac issues in the dim history of the bug tracker. Would you be the right person to roll libFlac to the new version?

I only fixed a compiler warning there once, but sure :-)

Taking a stab here: https://codereview.chromium.org/1961133002/
I still need to test that though.

Both CVEs refer to the stream decoder, which I don't think Chromium ever uses (flac is used for encoding voice input sent to Google's speech recognition service). Can we remove Restrict-View-SecurityTeam?

Google Play Music - a service offered by Google(available on Android, iOS & "Web") allows users to play a local ".flac" file stored on their system.

The application(whilst being used on the PC Web and not iOS/Android apps) plays the file within the Chrome Browser itself and most probably makes use of the vulnerable "stream_decoder.c" file within the "libFlac" library considering it is the most apt library within Chromium for the said file type.

The only code in Chromium using third_party/flac is the speech recognition code.

I don't know how Play Music works. Last I heard, they were using Flash for playback.

But we should fix this anyway, it's no good being stuck on an ancient version.

Thanks hans for picking this up. I've removed the view restrictions.

P.S. Thank you to the original reporter for noticing this had gotten out of date.

@hans, I completely agree with you, it isn't good to be stuck on an ancient version for long.

@felt, Thank you for considering this report and for initiating the fix so quickly.

PS: Any chance of a reward on this one like " Issue 560291 " reported earlier this year? Just trying out my luck..:)

Based on comment 4 I'd say probably not, as it doesn't seem likely that these issues would be reachable in chrome. If you could provide a test case demonstrating that they could be exploited, we would certainly consider it for a reward.

Thanks for the report either way, we do appreciate it.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/607364754c497842182a9c776e492564689d8d4f

commit 607364754c497842182a9c776e492564689d8d4f
Author: hans <hans@chromium.org>
Date: Tue May 10 20:11:26 2016

Roll flac 2c4b86af:2d224742

9fc1ca46 Update flac URL in README.chromium.
59c0c55a Update FLAC to 1.3.1
2d224742 README.chromium: restore the Name field

BUG= 610125 

Review-Url: https://codereview.chromium.org/1965553004
Cr-Commit-Position: refs/heads/master@{#392693}

[modify] https://crrev.com/607364754c497842182a9c776e492564689d8d4f/DEPS

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/6e971665cbbc1d270560da93b3736bf9907ce88f

commit 6e971665cbbc1d270560da93b3736bf9907ce88f
Author: hans <hans@chromium.org>
Date: Tue May 10 21:55:47 2016

Revert of Roll flac 2c4b86af:2d224742 (patchset #2 id:20001 of https://codereview.chromium.org/1965553004/ )

Reason for revert:
Broke e.g. https://build.chromium.org/p/chromium.fyi/builders/CrWinClang/builds/8652/steps/compile/logs/stdio

Reverting while investigating.

Original issue's description:
> Roll flac 2c4b86af:2d224742
>
> 9fc1ca46 Update flac URL in README.chromium.
> 59c0c55a Update FLAC to 1.3.1
> 2d224742 README.chromium: restore the Name field
>
> BUG= 610125 
>
> Committed: https://crrev.com/607364754c497842182a9c776e492564689d8d4f
> Cr-Commit-Position: refs/heads/master@{#392693}

TBR=felt@chromium.org,thakis@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= 610125 

Review-Url: https://codereview.chromium.org/1969573002
Cr-Commit-Position: refs/heads/master@{#392736}

[modify] https://crrev.com/6e971665cbbc1d270560da93b3736bf9907ce88f/DEPS

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ddaa08c81fadf7df21cc9dcdb11d8cb95617386d

commit ddaa08c81fadf7df21cc9dcdb11d8cb95617386d
Author: hans <hans@chromium.org>
Date: Wed May 11 01:19:36 2016

Roll flac 2c4b86af:812243a8

9fc1ca46 Update flac URL in README.chromium.
59c0c55a Update FLAC to 1.3.1
2d224742 README.chromium: restore the Name field
812243a8 Add missing extern declaration of inline function

BUG= 610125 

Review-Url: https://codereview.chromium.org/1968613003
Cr-Commit-Position: refs/heads/master@{#392806}

[modify] https://crrev.com/ddaa08c81fadf7df21cc9dcdb11d8cb95617386d/DEPS