From 2cc3c5b2b5f16287fc8464e3506a5c6607340270 Mon Sep 17 00:00:00 2001
From: Kramer Ge <fangzhoug@chromium.org>
Date: Mon, 08 Dec 2025 14:05:38 -0800
Subject: [PATCH] Resolve WaylandWpColorManager::Observer UAF

`WaylandWpColorManagementOutput` is observing `WaylandWpColorManager`.
The former outlives the latter because former is owned by
`WaylandOutput` and is destroyed in member list.

Fixed: 462468374, 461877477
Change-Id: Ida658bf700a8686b3f87c233e627d87981454436
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7239547
Commit-Queue: Kramer Ge <fangzhoug@chromium.org>
Reviewed-by: Thomas Anderson <thomasanderson@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1555723}
---

diff --git a/ui/ozone/platform/wayland/host/wayland_wp_color_management_output.cc b/ui/ozone/platform/wayland/host/wayland_wp_color_management_output.cc
index e80056c..e730f6f3 100644
--- a/ui/ozone/platform/wayland/host/wayland_wp_color_management_output.cc
+++ b/ui/ozone/platform/wayland/host/wayland_wp_color_management_output.cc
@@ -58,6 +58,10 @@
                      weak_factory_.GetWeakPtr()));
 }
 
+void WaylandWpColorManagementOutput::OnColorManagerDestroyed() {
+  color_manager_observation_.Reset();
+}
+
 void WaylandWpColorManagementOutput::OnImageDescription(
     scoped_refptr<WaylandWpImageDescription> image_description) {
   if (!image_description) {
diff --git a/ui/ozone/platform/wayland/host/wayland_wp_color_management_output.h b/ui/ozone/platform/wayland/host/wayland_wp_color_management_output.h
index 8f235dd..f01976d 100644
--- a/ui/ozone/platform/wayland/host/wayland_wp_color_management_output.h
+++ b/ui/ozone/platform/wayland/host/wayland_wp_color_management_output.h
@@ -46,6 +46,7 @@
 
   // WaylandWpColorManager::Observer:
   void OnHdrEnabledChanged(bool hdr_enabled) override;
+  void OnColorManagerDestroyed() override;
 
   void GetCurrentColorSpace();
   void OnImageDescription(
diff --git a/ui/ozone/platform/wayland/host/wayland_wp_color_management_surface.cc b/ui/ozone/platform/wayland/host/wayland_wp_color_management_surface.cc
index 9c245b4..8089dc5 100644
--- a/ui/ozone/platform/wayland/host/wayland_wp_color_management_surface.cc
+++ b/ui/ozone/platform/wayland/host/wayland_wp_color_management_surface.cc
@@ -8,6 +8,7 @@
 #include "base/logging.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/notimplemented.h"
+#include "base/notreached.h"
 #include "ui/gfx/display_color_spaces.h"
 #include "ui/ozone/platform/wayland/host/wayland_connection.h"
 #include "ui/ozone/platform/wayland/host/wayland_surface.h"
@@ -124,4 +125,8 @@
           : base::MakeRefCounted<gfx::DisplayColorSpacesRef>());
 }
 
+void WaylandWpColorManagementSurface::OnColorManagerDestroyed() {
+  NOTREACHED();
+}
+
 }  // namespace ui
diff --git a/ui/ozone/platform/wayland/host/wayland_wp_color_management_surface.h b/ui/ozone/platform/wayland/host/wayland_wp_color_management_surface.h
index 4d63600..3db62dde 100644
--- a/ui/ozone/platform/wayland/host/wayland_wp_color_management_surface.h
+++ b/ui/ozone/platform/wayland/host/wayland_wp_color_management_surface.h
@@ -49,6 +49,7 @@
 
   // WaylandWpColorManager::Observer:
   void OnHdrEnabledChanged(bool hdr_enabled) override;
+  void OnColorManagerDestroyed() override;
 
   void OnSetColorSpace(
       scoped_refptr<WaylandWpImageDescription> image_description);
diff --git a/ui/ozone/platform/wayland/host/wayland_wp_color_manager.cc b/ui/ozone/platform/wayland/host/wayland_wp_color_manager.cc
index 7c4d29bb..8ac5b579 100644
--- a/ui/ozone/platform/wayland/host/wayland_wp_color_manager.cc
+++ b/ui/ozone/platform/wayland/host/wayland_wp_color_manager.cc
@@ -169,7 +169,11 @@
   wp_color_manager_v1_add_listener(manager_.get(), &kListener, this);
 }
 
-WaylandWpColorManager::~WaylandWpColorManager() = default;
+WaylandWpColorManager::~WaylandWpColorManager() {
+  for (auto& observer : observers_) {
+    observer.OnColorManagerDestroyed();
+  }
+}
 
 void WaylandWpColorManager::GetImageDescription(
     const gfx::ColorSpace& color_space,
diff --git a/ui/ozone/platform/wayland/host/wayland_wp_color_manager.h b/ui/ozone/platform/wayland/host/wayland_wp_color_manager.h
index 0599b06..e7e52dfb 100644
--- a/ui/ozone/platform/wayland/host/wayland_wp_color_manager.h
+++ b/ui/ozone/platform/wayland/host/wayland_wp_color_manager.h
@@ -34,6 +34,7 @@
     ~Observer() override = default;
 
     virtual void OnHdrEnabledChanged(bool hdr_enabled) = 0;
+    virtual void OnColorManagerDestroyed() = 0;
   };
 
   static constexpr char kInterfaceName[] = "wp_color_manager_v1";