Commit message: None
CVE: CVE-2017-5056
CWE: CWE-125
Vulnerability description: A use after free in Blink in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

Project: Chrome

void ConnectCallback(bool* success, bool result) {
  *success = result;
}

Project: Chrome

  mojo::PendingRemote<mojom::InputChannel> CreatePendingRemote() {
    return receiver_.BindNewPipeAndPassRemote();
   }

Project: Chrome

  ImeServiceTest() : service_(remote_service_.BindNewPipeAndPassReceiver()) {}

Project: Chrome

  TestClientChannel() : receiver_(this) {}

Project: Chrome

void TestGetRulebasedKeypressCountForTestingCallback(int32_t* res_out,
                                                     int32_t response) {
  *res_out = response;
}

Project: Chrome

void TestProcessKeypressForRulebasedCallback(
    mojom::KeypressResponseForRulebased* res_out,
    mojom::KeypressResponseForRulebasedPtr response) {
  res_out->result = response->result;
  res_out->operations = std::vector<mojom::OperationForRulebasedPtr>(0);
  for (int i = 0; i < (int)response->operations.size(); i++) {
    res_out->operations.push_back(std::move(response->operations[i]));
  }
}

Project: Chrome

bool InputEngine::BindRequest(
    const std::string& ime_spec,
    mojo::PendingReceiver<mojom::InputChannel> receiver,
    mojo::PendingRemote<mojom::InputChannel> remote,
    const std::vector<uint8_t>& extra) {
  if (!IsImeSupportedByRulebased(ime_spec))
    return false;

  channel_receivers_.Add(this, std::move(receiver),
                         std::make_unique<InputEngineContext>(ime_spec));

  return true;
}

Project: Chrome

mojom::KeypressResponseForRulebasedPtr GenerateKeypressResponseForRulebased(
    rulebased::ProcessKeyResult& process_key_result) {
  mojom::KeypressResponseForRulebasedPtr keypress_response =
      mojom::KeypressResponseForRulebased::New();
  keypress_response->result = process_key_result.key_handled;
  if (!process_key_result.commit_text.empty()) {
    std::string commit_text;
    base::EscapeJSONString(process_key_result.commit_text, false, &commit_text);
    keypress_response->operations.push_back(mojom::OperationForRulebased::New(
        mojom::OperationMethodForRulebased::COMMIT_TEXT, commit_text));
  }
  if (!process_key_result.composition_text.empty() ||
      (process_key_result.key_handled &&
       process_key_result.commit_text.empty())) {
    std::string composition_text;
    base::EscapeJSONString(process_key_result.composition_text, false,
                           &composition_text);
    keypress_response->operations.push_back(mojom::OperationForRulebased::New(
        mojom::OperationMethodForRulebased::SET_COMPOSITION, composition_text));
  }
  return keypress_response;
}

Project: Chrome

uint8_t GenerateModifierValueForRulebased(bool shift, bool altgr, bool caps) {
  uint8_t modifiers = 0;
  if (shift)
    modifiers |= rulebased::MODIFIER_SHIFT;
  if (altgr)
    modifiers |= rulebased::MODIFIER_ALTGR;
  if (caps)
    modifiers |= rulebased::MODIFIER_CAPSLOCK;
  return modifiers;
}

Project: Chrome

std::string GetIdFromImeSpec(const std::string& ime_spec) {
  static const std::string kPrefix("m17n:");
  return base::StartsWith(ime_spec, kPrefix, base::CompareCase::SENSITIVE)
             ? ime_spec.substr(kPrefix.length())
             : std::string();
}

Project: Chrome

void InputEngine::GetRulebasedKeypressCountForTesting(
    GetRulebasedKeypressCountForTestingCallback callback) {
  auto& context = channel_receivers_.current_context();
  auto& engine = context.get()->engine;
  std::move(callback).Run(engine ? engine->process_key_count() : -1);
}

Project: Chrome

InputEngine::InputEngine() {}

Project: Chrome

InputEngineContext::InputEngineContext(const std::string& ime) : ime_spec(ime) {
  std::string id = GetIdFromImeSpec(ime_spec);
  if (rulebased::Engine::IsImeSupported(id)) {
    engine = std::make_unique<rulebased::Engine>();
    engine->Activate(id);
  }
}

Project: Chrome

bool InputEngine::IsImeSupportedByRulebased(const std::string& ime_spec) {
   return rulebased::Engine::IsImeSupported(GetIdFromImeSpec(ime_spec));
 }

Project: Chrome

 void InputEngine::ProcessMessage(const std::vector<uint8_t>& message,
                                  ProcessMessageCallback callback) {
   NOTIMPLEMENTED();  // Protobuf message is not used in the rulebased engine.
}

Project: Chrome

void InputEngine::ResetForRulebased() {
  auto& context = channel_receivers_.current_context();
  auto& engine = context.get()->engine;
  if (engine) {
    engine->Reset();
  }
}

Project: Chrome

InputEngine::~InputEngine() {}

Project: Chrome

InputEngineContext::~InputEngineContext() {}