Uplift of #7832 (squashed) to release

brave · Feb 10, 2021 · 37a046b · 37a046b
1 parent 94b0001
commit 37a046b
Showing 1 changed file with 9 additions and 1 deletion.
diff --git a/chromium_src/ui/accessibility/platform/ax_platform_node_mac.mm b/chromium_src/ui/accessibility/platform/ax_platform_node_mac.mm
@@ -8,8 +8,10 @@
 
 // Assumed to be a temporary fix for
 // https://github.com/brave/brave-browser/issues/13778
+// and
+// https://github.com/brave/brave-browser/issues/13837
 #define BRAVE_ACCESSIBILITY_ATTRIBUTED_STRING_FOR_RANGE             \
-  id value = [self getAXValueAsString];                             \
+  id value = [self AXValue];                                        \
   if (![value isKindOfClass:[NSString class]]) {                    \
     ax::mojom::Role role = _node->GetData().role;                   \
     base::debug::Alias(&role);                                      \
@@ -19,6 +21,12 @@
                << " Name: " << _node->GetName();                    \
     base::debug::DumpWithoutCrashing();                             \
     return nil;                                                     \
+  }                                                                 \
+  NSString* str = value;                                            \
+  if (range.location == NSNotFound ||                               \
+      range.location + range.length > str.length) {                 \
+    base::debug::DumpWithoutCrashing();                             \
+    return nil;                                                     \
   }
 
 #include "../../../../ui/accessibility/platform/ax_platform_node_mac.mm"