Chromium IndexedDB Use-After-Free CVE-2025-11460 취약점 분석

Status Database::ForceCloseAndRunTasks(const std::string& message) { if (!bucket_context_->ShouldUseSqlite()) { DCHECK(!force_closing_); } else if (force_closing_) { // Re-entrancy can validly occur if there's an error in the code below, // e.g. in `CloseAndReportForceClose`. return Status::OK(); } force_closing_ = true; // set force_closing_ true for (Connection* connection : connections_) { connection->CloseAndReportForceClose(message); // destroy connection (free) } connections_.clear(); // clear active connections list IDB_RETURN_IF_ERROR(connection_coordinator_.PruneTasksForForceClose(message)); connection_coordinator_.OnNoConnections(); // Execute any pending tasks in the connection coordinator. ConnectionCoordinator::ExecuteTaskResult task_state; Status status; do { std::tie(task_state, status) = connection_coordinator_.ExecuteTask(false); DCHECK(task_state != ConnectionCoordinator::ExecuteTaskResult::kPendingAsyncWork) << "There are no more connections, so all tasks should be able to " "complete synchronously."; } while (task_state != ConnectionCoordinator::ExecuteTaskResult::kDone && task_state != ConnectionCoordinator::ExecuteTaskResult::kError); DCHECK(connections_.empty()); bucket_context_->QueueRunTasks(); // Queue BucketContext::RunTasks (destroy connection) return status; }

Connection::~Connection() { DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); is_shutting_down_ = true; if (!IsConnected()) { return; } AbortTransactionsAndClose(CloseErrorHandling::kAbortAllReturnLastError, "The connection is destroyed."); } std::unique_ptr<DatabaseCallbacks> Connection::AbortTransactionsAndClose( CloseErrorHandling error_handling, const std::string& message) { DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); if (!IsConnected()) { return {}; } //... std::unique_ptr<DatabaseCallbacks> callbacks = std::move(callbacks_); std::move(on_close_).Run(this); // on_close_ callback -> call ConnectionClosed for (auto& remotes : client_keep_active_remotes_) { remotes.reset(); } bucket_context_handle_->quota_manager()->NotifyBucketAccessed( bucket_context_handle_->bucket_locator(), base::Time::Now()); if (!status.ok()) { bucket_context_handle_->OnDatabaseError(database_.get(), status, {}); } bucket_context_handle_.Release(); return callbacks; } void Database::ConnectionClosed(Connection* connection) { TRACE_EVENT0("IndexedDB", "Database::ConnectionClosed"); // Ignore connection closes during force close to prevent re-entry. if (force_closing_) { return; } connections_.erase(connection); connection_coordinator_.OnConnectionClosed(connection); if (connections_.empty()) { connection_coordinator_.OnNoConnections(); } if (CanBeDestroyed()) { bucket_context_->QueueRunTasks(); } }

void BucketContext::RunTasks() { task_run_queued_ = false; for (auto db_it = databases_.begin(); db_it != databases_.end();) { Database& db = *db_it->second; Status status = db.RunTasks(); if (!status.ok()) { OnDatabaseError(&db, status, {}); return; } if (db.CanBeDestroyed()) { db_it = databases_.erase(db_it); } else { ++db_it; } } if (CanClose() && closing_stage_ == ClosingState::kClosed) { ResetBackingStore(); } }

void Database::ConnectionClosed(Connection* connection) { TRACE_EVENT0("IndexedDB", "Database::ConnectionClosed"); // Ignore connection closes during force close to prevent re-entry. if (force_closing_) { return; } connections_.erase(connection); connection_coordinator_.OnConnectionClosed(connection); if (connections_.empty()) { connection_coordinator_.OnNoConnections(); } if (CanBeDestroyed()) { bucket_context_->QueueRunTasks(); } }

for (Connection* connection : connections_) { std::vector<int64_t> txns_to_remove; for (const auto& id_txn_pair : connection->transactions()) { Transaction* txn = id_txn_pair.second.get(); // get Transaction // Determine if the transaction's task queue should be processed. switch (txn->state()) { case Transaction::FINISHED: if (txn->mode() == blink::mojom::IDBTransactionMode::VersionChange) { finished_upgrade_transaction = txn; upgrade_transaction_commmitted = !txn->aborted(); } txns_to_remove.push_back(id_txn_pair.first); continue; case Transaction::CREATED: continue; case Transaction::STARTED: case Transaction::COMMITTING: break; } // Process the queue for transactions that are STARTED or COMMITTING. // Add transactions that can be removed to a queue. StatusOr<Transaction::RunTasksResult> task_result = txn->RunTasks();

StatusOr<Transaction::RunTasksResult> Transaction::RunTasks() { ... // If there are no pending tasks, we haven't already committed/aborted, // and the front-end requested a commit, it is now safe to do so. if (!HasPendingTasks() && state_ == STARTED && is_commit_pending_) { processing_event_queue_ = false; Status result = DoPendingCommit(); if (!result.ok()) { // This can delete |this|. return base::unexpected(result); }; } ... }

Status Transaction::DoPendingCommit() { TRACE_EVENT1("IndexedDB", "Transaction::DoPendingCommit", "txn.id", id()); ResetTimeoutTimer(); ... } void Transaction::ResetTimeoutTimer() { timeout_timer_.Stop(); timeout_strikes_ = 0; } void DelayedTaskHandle::CancelTask() { // The delegate is responsible for cancelling the task. if (delegate_) { delegate_->CancelTask(); DCHECK(!delegate_->IsValid()); delegate_.reset(); } }

class DelayedTaskHandleDelegate : public DelayedTaskHandle::Delegate { public: explicit DelayedTaskHandleDelegate(TaskQueueImpl* outer); DelayedTaskHandleDelegate(const DelayedTaskHandleDelegate&) = delete; DelayedTaskHandleDelegate& operator=(const DelayedTaskHandleDelegate&) = delete; ~DelayedTaskHandleDelegate() override; WeakPtr<DelayedTaskHandleDelegate> AsWeakPtr(); // DelayedTaskHandle::Delegate: bool IsValid() const override; void CancelTask() override; void SetHeapHandle(HeapHandle heap_handle); void ClearHeapHandle(); HeapHandle GetHeapHandle(); // Indicates that this task will be executed. This will invalidate the handle. void WillRunTask(); private: // The TaskQueueImpl where the task was posted. // RAW_PTR_EXCLUSION: Performance reasons (based on analysis of speedometer3). RAW_PTR_EXCLUSION TaskQueueImpl* const outer_ GUARDED_BY_CONTEXT(sequence_checker_) = nullptr; // The HeapHandle to the task, if the task is in the DelayedIncomingQueue, // invalid otherwise. HeapHandle heap_handle_ GUARDED_BY_CONTEXT(sequence_checker_); SEQUENCE_CHECKER(sequence_checker_); // Allows TaskQueueImpl to retain a weak reference to |this|. An outstanding // weak pointer indicates that the task is valid. WeakPtrFactory<DelayedTaskHandleDelegate> weak_ptr_factory_ GUARDED_BY_CONTEXT(sequence_checker_){this}; };