diff --git a/content/browser/interest_group/interest_group_priority_util.cc b/content/browser/interest_group/interest_group_priority_util.cc index d4d40fd43022c1..038aeabef34b6d 100644 --- a/content/browser/interest_group/interest_group_priority_util.cc +++ b/content/browser/interest_group/interest_group_priority_util.cc @@ -4,6 +4,7 @@ #include "content/browser/interest_group/interest_group_priority_util.h" +#include #include #include @@ -89,6 +90,13 @@ double CalculateInterestGroupPriority( break; } } + // Multiplying or summing large finite inputs can overflow to +/-Inf and + // then to NaN, which would later violate strict-weak-ordering in + // std::sort and corrupt heap memory in ApplySizeLimitAndSort(). Clamp to + // a safe value; the priority is only used for relative ordering. + if (!std::isfinite(caclulated_priority)) { + return 0; + } return caclulated_priority; }