Validate input of MediaStreamDispatcherHost::OpenDevice()
This method forwards to MediaStreamManager::OpenDevice(), which
DCHECKs for the stream type to be device video or audio capture
(i.e., webcam or mic). However, MSDH admits other stream types,
which cause MSM::OpenDevice to hit this DCHECK.
This CL ensures that a message containing an incorrect stream type,
which could be sent by a malicious renderer, results in killing the
renderer process.
(cherry picked from commit 229fdaf8fc05e0eeadad380d401c191afd822d92)
Bug: 1135018
Change-Id: I3884dde95d92c41f44966a8ab1dd7bdfd4b23b9b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2472397
Auto-Submit: Guido Urdaneta <[email protected]>
Commit-Queue: Guido Urdaneta <[email protected]>
Reviewed-by: Avi Drissman <[email protected]>
Cr-Original-Commit-Position: refs/heads/master@{#817151}
TBR: [email protected]
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2485055
Reviewed-by: Guido Urdaneta <[email protected]>
Cr-Commit-Position: refs/branch-heads/4280@{#493}
Cr-Branched-From: ea420fb963f9658c9969b6513c56b8f47efa1a2a-refs/heads/master@{#812852}
diff --git a/content/browser/bad_message.h b/content/browser/bad_message.h
index 25f1a39..c6675ef 100644
--- a/content/browser/bad_message.h
+++ b/content/browser/bad_message.h
@@ -259,6 +259,7 @@
RFH_CSP_ATTRIBUTE = 231,
RFH_RECEIVED_ASSOCIATED_MESSAGE_WHILE_BFCACHED = 232,
RWH_CLOSE_PORTAL = 233,
+ MSDH_INVALID_STREAM_TYPE = 234,
// Please add new elements here. The naming convention is abbreviated class
// name (e.g. RenderFrameHost becomes RFH) plus a unique description of the
diff --git a/content/browser/renderer_host/media/media_stream_dispatcher_host.cc b/content/browser/renderer_host/media/media_stream_dispatcher_host.cc
index 3e43ba7..835c9be6 100644
--- a/content/browser/renderer_host/media/media_stream_dispatcher_host.cc
+++ b/content/browser/renderer_host/media/media_stream_dispatcher_host.cc
@@ -196,6 +196,13 @@
blink::mojom::MediaStreamType type,
OpenDeviceCallback callback) {
DCHECK_CURRENTLY_ON(BrowserThread::IO);
+ // OpenDevice is only supported for microphone or webcam capture.
+ if (type != blink::mojom::MediaStreamType::DEVICE_AUDIO_CAPTURE &&
+ type != blink::mojom::MediaStreamType::DEVICE_VIDEO_CAPTURE) {
+ bad_message::ReceivedBadMessage(
+ render_process_id_, bad_message::MDDH_INVALID_DEVICE_TYPE_REQUEST);
+ return;
+ }
base::PostTaskAndReplyWithResult(
GetUIThreadTaskRunner({}).get(), FROM_HERE,
diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index 3fcbad9..d2229e3 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml
@@ -6471,6 +6471,7 @@
<int value="231" label="RFH_CSP_ATTRIBUTE"/>
<int value="232" label="RFH_RECEIVED_ASSOCIATED_MESSAGE_WHILE_BFCACHED"/>
<int value="233" label="RWH_CLOSE_PORTAL"/>
+ <int value="234" label="MSDH_INVALID_STREAM_TYPE"/>
</enum>
<enum name="BadMessageReasonExtensions">
