New issue
Advanced search Search tips

Issue 629096 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Nov 2016
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Terminate renderers that send invalid Blimp Mojo requests to the browser process

Project Member Reported by kmarshall@chromium.org, Jul 18 2016

Issue description

We should work out how to make the browser process turn invalid input errors into renderer teardowns, since they indicate the renderer violating the protocol.

(From https://codereview.chromium.org/2033013003/diff/240001/blimp/engine/mojo/blob_channel_service.cc)

 

Comment 1 by w...@chromium.org, Jul 27 2016

Labels: -Pri-3 M-55 OS-Linux Pri-2
Status: Available (was: Untriaged)
Summary: Add mechanism to terminate renderers that send invalid Mojo requests to the browser process (was: Design mechanism for the browser to tearing down renderers on invalid IPC)
This is desirable as a security mitigation, but is not necessary at this stage of development, so scheduling as Available for M55.

Comment 2 by w...@chromium.org, Nov 15 2016

Labels: -M-55 M-57
Owner: kmarshall@chromium.org
Status: Assigned (was: Available)
Summary: Terminate renderers that send invalid Blimp Mojo requests to the browser process (was: Add mechanism to terminate renderers that send invalid Mojo requests to the browser process)
kmarshall to check what the recommended mechanism is for this.
Project Member

Comment 3 by bugdroid1@chromium.org, Nov 19 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2de9572364f3e2b29aad7837ec0d36651464a1f7

commit 2de9572364f3e2b29aad7837ec0d36651464a1f7
Author: kmarshall <kmarshall@chromium.org>
Date: Sat Nov 19 01:35:26 2016

Throw IPC errors on invalid Mojo BlobChannel messages.
This code instructs the browser to kill a renderer process if it
receives semantically invalid/bad data over the Mojo pipe.

BUG= 629096 
R=mlliu@chromium.org
CC=wez@chromium.org

Review-Url: https://codereview.chromium.org/2517733002
Cr-Commit-Position: refs/heads/master@{#433371}

[modify] https://crrev.com/2de9572364f3e2b29aad7837ec0d36651464a1f7/blimp/engine/mojo/blob_channel_service.cc

Status: Verified (was: Assigned)
Labels: Archive-Blimp

Sign in to add a comment