void BrowserPpapiHostImpl::AddInstance(
    PP_Instance instance,
    const PepperRendererInstanceData& renderer_instance_data) {
  DCHECK(instance_map_.find(instance) == instance_map_.end());  <---DCHECK not compiled in release version
  instance_map_[instance] =
      base::MakeUnique<InstanceData>(renderer_instance_data);
}

bbudge, could you please take a look and help assess severity? I'm not sure what the security implications of this bug might be. Thanks!

This seems to allow a malicious plugin to add non-existent PP_Instance's to the map too. It's hard to say how bad this would be. It seems prudent to check the PP_Instance. However, I don't know how to do this offhand, as nobody has been working on Pepper much.

Perhaps Raymes can provide more in-depth analysis.

Tentatively assigning high severity out of an abundance of caution.

Fix landed in trunk.

https://chromium-review.googlesource.com/c/538908/

This bug requires manual review: M60 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: amineer@(Android), cmasso@(iOS), josafat@(ChromeOS), bustamante@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Please mark security bugs as fixed as soon as the fix lands, and before requesting merges. This update is based on the merge- labels applied to this issue. Please reopen if this update was incorrect.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Can you confirm if this has landed in canary and verified the fix?

It is in Canary. I have no way to reproduce the issue, but the fix is very simple. The fix is by the same CL as for  issue 733549 .

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2e98fb826886c18acdd55890ee0b52d2aee57394

commit 2e98fb826886c18acdd55890ee0b52d2aee57394
Author: Bill Budge <bbudge@chromium.org>
Date: Fri Jun 23 22:23:17 2017

Validate in-process plugin instance messages.

Bug:  733548 ,  733549 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_site_isolation
Change-Id: Ie5572c7bcafa05399b09c44425ddd5ce9b9e4cba
Reviewed-on: https://chromium-review.googlesource.com/538908
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Raymes Khoury <raymes@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#480696}
Review-Url: https://codereview.chromium.org/2955703002 .
Cr-Commit-Position: refs/branch-heads/3112@{#456}
Cr-Branched-From: b6460e24cf59f429d69de255538d0fc7a425ccf9-refs/heads/master@{#474897}

[modify] https://crrev.com/2e98fb826886c18acdd55890ee0b52d2aee57394/content/browser/renderer_host/pepper/browser_ppapi_host_impl.cc
[modify] https://crrev.com/2e98fb826886c18acdd55890ee0b52d2aee57394/content/browser/renderer_host/pepper/pepper_renderer_connection.cc

Approving merge to M60. 

Hi scdengyuan@. The VRP panel has looked at this, and ask if you could provide a proof of concept, or details about how this could be triggered?

run the code below in a malicious plugin, then you can overwrite an existent PP_Instance in the broker, or add non-existent PP_Instance's to the map.

Send(new FrameHostMsg_DidCreateInProcessInstance(
      fake_instance,
      PepperRendererInstanceData(0x41414141, 0x41414141, "AAAAA", "AAAA", true)));

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Removing merge-approved label.

Per our email conversation, we're covering the reward payment for this issue with 733549.  Thanks!

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot