Handle an ill formed response from UpdateClient::CrxDataCallback.
There could be executions path in the code where early returns in
the callback implementations return an empty vector instead of
a vector of CrxComponent of the same size as the input parameter
of the callback.
When this occurs, the original code indexes out of bounds and crashes.
With the fix, if the callback returns fewer values than the number of
components checked for updates, the UpdateClient::Update call is
rejected by the update engine, and completed with a specific error code.
Bug: 1144880
Change-Id: If45910c7c9ea0ca940b2d5a3d936b96a31d9c684
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2518001
Reviewed-by: Joshua Pawlicki <[email protected]>
Commit-Queue: Sorin Jianu <[email protected]>
Cr-Commit-Position: refs/heads/master@{#823985}
diff --git a/components/update_client/update_client.h b/components/update_client/update_client.h
index be4f702..f462b297 100644
--- a/components/update_client/update_client.h
+++ b/components/update_client/update_client.h
@@ -331,6 +331,12 @@
// the browser process has gone single-threaded.
class UpdateClient : public base::RefCountedThreadSafe<UpdateClient> {
public:
+ // Returns `CrxComponent` instances corresponding to the component ids
+ // passed as an argument to the callback. The order of components in the input
+ // and output vectors must match. If the instance of the `CrxComponent` is not
+ // available for some reason, implementors of the callback must not skip
+ // skip the component, and instead, they must insert a `nullopt` value in
+ // the output vector.
using CrxDataCallback =
base::OnceCallback<std::vector<base::Optional<CrxComponent>>(
const std::vector<std::string>& ids)>;
