which in turn is referencing this new release from this past Friday: https://chromereleases.googleblog.com/2019/03/stable-channel...
which seems to have been motivated by "CVE-2019-5786: Use-after-free in FileReader. Reported by Clement Lecigne of Google's Threat Analysis Group on 2019-02-27".
That CVE is still reserved/non-public on the Mitre NVD though.
But DOMArrayBuffer::Create() here takes ownership of the memory from ToArrayBuffer(), so in the latter case of a smart pointer, the internal buffer of raw_data_ is immediately invalidated and its value becomes undefined after creating the DOMArrayBuffer. This is fine if file loading is finished at this point because raw_data_ is reset to nullptr, but if the load is partial, then the undefined value in raw_data_ will be reused to create another DOMArrayBuffer which is then accessible in javascript. Hence the use after free.
I'll attribute the root cause of this bug to unclear memory ownership passing in interface design.
> Please submit the original source. If a post reports on something found on another site, submit the latter.
Clickbait blogspam, right to the top! Nice work HN!