cef/fix-page-allocator-overflow.patch
Than Ngo 28dc83db64 Update to 140.0.7339.80 (rhbz#2396308)
- * Update to cef-140.1.15+gfaef09b (rhbz#2380429) (Asahi Lina)
- * CVE-2025-9864: Use after free in V8
- * CVE-2025-9865: Inappropriate implementation in Toolbar
- * CVE-2025-9866: Inappropriate implementation in Extensions
- * CVE-2025-9867: Inappropriate implementation in Downloads
2025-09-30 22:13:00 +09:00

26 lines
1.6 KiB
Diff

Index: chromium-140.0.7339.41/base/allocator/dispatcher/tls.h
===================================================================
--- chromium-140.0.7339.41.orig/base/allocator/dispatcher/tls.h
+++ chromium-140.0.7339.41/base/allocator/dispatcher/tls.h
@@ -88,6 +88,8 @@ struct BASE_EXPORT MMapAllocator {
constexpr static size_t AllocationChunkSize = 16384;
#elif BUILDFLAG(IS_LINUX) && defined(ARCH_CPU_ARM64)
constexpr static size_t AllocationChunkSize = 16384;
+#elif BUILDFLAG(IS_LINUX) && defined(ARCH_CPU_PPC64)
+ constexpr static size_t AllocationChunkSize = 16384;
#else
constexpr static size_t AllocationChunkSize = 4096;
#endif
Index: chromium-140.0.7339.41/base/allocator/partition_allocator/src/partition_alloc/partition_alloc_constants.h
===================================================================
--- chromium-140.0.7339.41.orig/base/allocator/partition_allocator/src/partition_alloc/partition_alloc_constants.h
+++ chromium-140.0.7339.41/base/allocator/partition_allocator/src/partition_alloc/partition_alloc_constants.h
@@ -397,7 +397,7 @@ PA_ALWAYS_INLINE constexpr size_t MaxDir
// TODO(casey.smalley@arm.com): under 64k pages we can end up in a situation
// where a normal slot span will be large enough to contain multiple items,
// but the address will go over the final partition page after being aligned.
-#if PA_BUILDFLAG(IS_LINUX) && PA_BUILDFLAG(PA_ARCH_CPU_ARM64)
+#if PA_BUILDFLAG(IS_LINUX) && (PA_BUILDFLAG(PA_ARCH_CPU_ARM64) || PA_BUILDFLAG(PA_ARCH_CPU_PPC64))
constexpr size_t kMaxSupportedAlignment = kSuperPageSize / 4;
#else
constexpr size_t kMaxSupportedAlignment = kSuperPageSize / 2;