Commit message: None
CVE: CVE-2019-5828
CWE: CWE-416
Vulnerability description: Object lifecycle issue in ServiceWorker in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

Project: Chrome

void PaymentHandlerWebFlowViewController::DidFinishNavigation(
    content::NavigationHandle* navigation_handle) {
  if (navigation_handle->IsSameDocument())
    return;

  if (!OriginSecurityChecker::IsOriginSecure(navigation_handle->GetURL()) ||
      (!OriginSecurityChecker::IsSchemeCryptographic(
           navigation_handle->GetURL()) &&
       !OriginSecurityChecker::IsOriginLocalhostOrFile(
           navigation_handle->GetURL()) &&
       !navigation_handle->GetURL().IsAboutBlank()) ||
      !SslValidityChecker::IsSslCertificateValid(
          navigation_handle->GetWebContents())) {
    if (!net::IsLocalhost(navigation_handle->GetURL())) {
      log_.Error("Aborting payment handler window \"" + target_.spec() +
                 "\" because of navigation to an insecure url \"" +
                 navigation_handle->GetURL().spec() + "\"");
      AbortPayment();
      return;
    }
  }

  if (first_navigation_complete_callback_) {
    std::move(first_navigation_complete_callback_)
        .Run(true, web_contents()->GetMainFrame()->GetProcess()->GetID(),
             web_contents()->GetMainFrame()->GetRoutingID());
    first_navigation_complete_callback_ = PaymentHandlerOpenWindowCallback();
  }

  UpdateHeaderView();
}

Project: Chrome

void PaymentRequestState::CheckHasEnrolledInstrument(StatusCallback callback) {
  DCHECK(get_all_instruments_finished_);
  bool has_enrolled_instrument_value = false;
  for (const auto& instrument : available_instruments_) {
    if (instrument->IsValidForCanMakePayment()) {
      has_enrolled_instrument_value = true;
      break;
    }
  }
  std::move(callback).Run(has_enrolled_instrument_value);
}

Project: Chrome

autofill::RegionDataLoader* PaymentRequestState::GetRegionDataLoader() {
  return payment_request_delegate_->GetRegionDataLoader();
}

Project: Chrome

 ServiceWorkerPaymentInstrument::CreatePaymentRequestEventData() {
   mojom::PaymentRequestEventDataPtr event_data =
      mojom::PaymentRequestEventData::New();

  event_data->top_origin = top_origin_;
  event_data->payment_request_origin = frame_origin_;

  if (spec_->details().id.has_value())
    event_data->payment_request_id = spec_->details().id.value();

  event_data->total = spec_->details().total->amount.Clone();

  std::unordered_set<std::string> supported_methods;
  if (needs_installation_) {
    supported_methods.insert(installable_enabled_method_);
  } else {
    supported_methods.insert(stored_payment_app_info_->enabled_methods.begin(),
                             stored_payment_app_info_->enabled_methods.end());
  }
  DCHECK(spec_->details().modifiers);
  for (const auto& modifier : *spec_->details().modifiers) {
    if (base::ContainsKey(supported_methods,
                          modifier->method_data->supported_method)) {
      event_data->modifiers.emplace_back(modifier.Clone());
    }
  }

  for (const auto& data : spec_->method_data()) {
    if (base::ContainsKey(supported_methods, data->supported_method)) {
      event_data->method_data.push_back(data.Clone());
    }
  }

  return event_data;
}

Project: Chrome

void ServiceWorkerPaymentInstrument::OnCanMakePaymentEventSkipped(
    ValidateCanMakePaymentCallback callback) {
  can_make_payment_result_ = true;
  has_enrolled_instrument_result_ = false;
  base::ThreadTaskRunnerHandle::Get()->PostTask(
      FROM_HERE,
      base::BindOnce(std::move(callback), this, can_make_payment_result_));
}