Use-after-free in FilePicker

[Chris Coulson]

The oxide::FilePicker class contains a pointer to the RenderViewHost that the picker is associated with. It is also a WebContentsObserver and implements WebContentsObserver::RenderViewDeleted with the intention of nulling out the RenderViewHost pointer when it's deleted.

However, unless I've missed something, it doesn't look like it calls WebContentsObserver::Observe or pass the associated WebContents to the WebContentsObserver constructor in order to attach itself and receive notifications.

The consequence of this is that RenderViewHost can be deleted (eg, by a process swap on navigation), leaving FilePicker with a dangling pointer which results in a potentially exploitable use-after-free.

[Marc Deslauriers (mdeslaur)]

This is CVE-2015-1321