Commit message: None
CVE: CVE-2016-5156
CWE: CWE-416
Vulnerability description: extensions/renderer/event_bindings.cc in the event bindings in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux attempts to process filtered events after failure to add an event matcher, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown vectors.

Project: Chrome

bool AddFilter(const std::string& event_name,
               const std::string& extension_id,
               const base::DictionaryValue& filter) {
  FilteredEventListenerKey key(extension_id, event_name);
  FilteredEventListenerCounts& all_counts = g_filtered_listener_counts.Get();
  FilteredEventListenerCounts::const_iterator counts = all_counts.find(key);
  if (counts == all_counts.end()) {
    counts =
        all_counts
            .insert(std::make_pair(key, base::WrapUnique(new ValueCounter())))
            .first;
  }
  return counts->second->Add(filter);
}

Project: Chrome

void EventBindings::AttachEvent(const std::string& event_name) {
  if (!context()->HasAccessOrThrowError(event_name))
    return;

  attached_event_names_.insert(event_name);

  const std::string& extension_id = context()->GetExtensionID();
  if (IncrementEventListenerCount(context(), event_name) == 1) {
    content::RenderThread::Get()->Send(new ExtensionHostMsg_AddListener(
        extension_id, context()->url(), event_name));
  }

  if (ExtensionFrameHelper::IsContextForEventPage(context())) {
    content::RenderThread::Get()->Send(
        new ExtensionHostMsg_AddLazyListener(extension_id, event_name));
  }
}

Project: Chrome

void EventBindings::DetachEvent(const std::string& event_name, bool is_manual) {
  attached_event_names_.erase(event_name);

  const std::string& extension_id = context()->GetExtensionID();

  if (DecrementEventListenerCount(context(), event_name) == 0) {
    content::RenderThread::Get()->Send(new ExtensionHostMsg_RemoveListener(
        extension_id, context()->url(), event_name));
  }

  if (is_manual && ExtensionFrameHelper::IsContextForEventPage(context())) {
    content::RenderThread::Get()->Send(
        new ExtensionHostMsg_RemoveLazyListener(extension_id, event_name));
  }
}

Project: Chrome

void EventBindings::DetachEventHandler(
    const v8::FunctionCallbackInfo<v8::Value>& args) {
  CHECK_EQ(2, args.Length());
  CHECK(args[0]->IsString());
  CHECK(args[1]->IsBoolean());
  DetachEvent(*v8::String::Utf8Value(args[0]), args[1]->BooleanValue());
}

Project: Chrome

void EventBindings::DetachFilteredEventHandler(
    const v8::FunctionCallbackInfo<v8::Value>& args) {
  CHECK_EQ(2, args.Length());
  CHECK(args[0]->IsInt32());
  CHECK(args[1]->IsBoolean());
  DetachFilteredEvent(args[0]->Int32Value(), args[1]->BooleanValue());
}

Project: Chrome

std::string GetKeyForScriptContext(ScriptContext* script_context) {
  const std::string& extension_id = script_context->GetExtensionID();
  CHECK(crx_file::id_util::IdIsValid(extension_id) ||
        script_context->url().is_valid());
  return crx_file::id_util::IdIsValid(extension_id)
             ? extension_id
             : script_context->url().spec();
}

Project: Chrome

int IncrementEventListenerCount(ScriptContext* script_context,
                                const std::string& event_name) {
  return ++g_listener_counts
               .Get()[GetKeyForScriptContext(script_context)][event_name];
}

Project: Chrome

void EventBindings::MatchAgainstEventFilter(
    const v8::FunctionCallbackInfo<v8::Value>& args) {
  v8::Isolate* isolate = args.GetIsolate();
  typedef std::set<EventFilter::MatcherID> MatcherIDs;
  EventFilter& event_filter = g_event_filter.Get();
  std::string event_name = *v8::String::Utf8Value(args[0]);
  EventFilteringInfo info =
      ParseFromObject(args[1]->ToObject(isolate), isolate);
  MatcherIDs matched_event_filters = event_filter.MatchEvent(
      event_name, info, context()->GetRenderFrame()->GetRoutingID());
  v8::Local<v8::Array> array(
      v8::Array::New(isolate, matched_event_filters.size()));
  int i = 0;
  for (MatcherIDs::iterator it = matched_event_filters.begin();
       it != matched_event_filters.end();
       ++it) {
    array->Set(v8::Integer::New(isolate, i++), v8::Integer::New(isolate, *it));
  }
  args.GetReturnValue().Set(array);
}

Project: Chrome

void EventBindings::OnInvalidated() {
  std::set<std::string> attached_event_names_safe = attached_event_names_;
  for (const std::string& event_name : attached_event_names_safe) {
    DetachEvent(event_name, false /* is_manual */);
  }
  DCHECK(attached_event_names_.empty())
      << "Events cannot be attached during invalidation";

  std::set<int> attached_matcher_ids_safe = attached_matcher_ids_;
  for (int matcher_id : attached_matcher_ids_safe) {
    DetachFilteredEvent(matcher_id, false /* is_manual */);
  }
  DCHECK(attached_matcher_ids_.empty())
      << "Filtered events cannot be attached during invalidation";
}

Project: Chrome

std::unique_ptr<EventMatcher> EventBindings::ParseEventMatcher(
    std::unique_ptr<base::DictionaryValue> filter) {
  return base::WrapUnique(new EventMatcher(
      std::move(filter), context()->GetRenderFrame()->GetRoutingID()));
}

Project: Chrome

EventFilteringInfo ParseFromObject(v8::Local<v8::Object> object,
                                   v8::Isolate* isolate) {
  EventFilteringInfo info;
  v8::Local<v8::String> url(v8::String::NewFromUtf8(isolate, "url"));
  if (object->Has(url)) {
    v8::Local<v8::Value> url_value(object->Get(url));
    info.SetURL(GURL(*v8::String::Utf8Value(url_value)));
  }
  v8::Local<v8::String> instance_id(
      v8::String::NewFromUtf8(isolate, "instanceId"));
  if (object->Has(instance_id)) {
    v8::Local<v8::Value> instance_id_value(object->Get(instance_id));
    info.SetInstanceID(instance_id_value->IntegerValue());
  }
  v8::Local<v8::String> service_type(
      v8::String::NewFromUtf8(isolate, "serviceType"));
  if (object->Has(service_type)) {
    v8::Local<v8::Value> service_type_value(object->Get(service_type));
    info.SetServiceType(*v8::String::Utf8Value(service_type_value));
  }
  v8::Local<v8::String> window_types(
      v8::String::NewFromUtf8(isolate, "windowType"));
  if (object->Has(window_types)) {
    v8::Local<v8::Value> window_types_value(object->Get(window_types));
    info.SetWindowType(*v8::String::Utf8Value(window_types_value));
  }

  v8::Local<v8::String> window_exposed(
      v8::String::NewFromUtf8(isolate, "windowExposedByDefault"));
  if (object->Has(window_exposed)) {
    v8::Local<v8::Value> window_exposed_value(object->Get(window_exposed));
    info.SetWindowExposedByDefault(
        window_exposed_value.As<v8::Boolean>()->Value());
  }

  return info;
}

Project: Chrome

bool RemoveFilter(const std::string& event_name,
                  const std::string& extension_id,
                  base::DictionaryValue* filter) {
  FilteredEventListenerKey key(extension_id, event_name);
  FilteredEventListenerCounts& all_counts = g_filtered_listener_counts.Get();
  FilteredEventListenerCounts::const_iterator counts = all_counts.find(key);
  if (counts == all_counts.end())
    return false;
  if (counts->second->Remove(*filter)) {
    if (counts->second->is_empty())
      all_counts.erase(counts);  // Clean up if there are no more filters.
    return true;
  }
  return false;
}

Project: Chrome

EventBindings::~EventBindings() {}