Code: ChooserContextBase::GetGrantedObjects(const GURL& requesting_origin,
                                      const GURL& embedding_origin) {
  DCHECK_EQ(requesting_origin, requesting_origin.GetOrigin());
  DCHECK_EQ(embedding_origin, embedding_origin.GetOrigin());

  if (!CanRequestObjectPermission(requesting_origin, embedding_origin))
     return {};
 
   std::vector<std::unique_ptr<Object>> results;
  auto* info = new content_settings::SettingInfo();
   std::unique_ptr<base::DictionaryValue> setting =
      GetWebsiteSetting(requesting_origin, embedding_origin, info);
   std::unique_ptr<base::Value> objects;
   if (!setting->Remove(kObjectListKey, &objects))
     return results;

  std::unique_ptr<base::ListValue> object_list =
      base::ListValue::From(std::move(objects));
  if (!object_list)
    return results;

  for (auto& object : *object_list) {
     base::DictionaryValue* object_dict;
     if (object.GetAsDictionary(&object_dict) && IsValidObject(*object_dict)) {
       results.push_back(std::make_unique<Object>(
          requesting_origin, embedding_origin, object_dict, info->source,
           host_content_settings_map_->is_incognito()));
     }
   }
  return results;
}

Vulnerability Type: DoS Overflow 
CWE ID: CWE-190
Summary: Integer overflow in the opj_tcd_get_decoded_tile_size function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data.
Commit Message: Fix memory leak in ChooserContextBase::GetGrantedObjects.

Bug: 854329
Change-Id: Ia163d503a4207859cd41c847c9d5f67e77580fbc
Reviewed-on: https://chromium-review.googlesource.com/c/1456080
Reviewed-by: Balazs Engedy <engedy@chromium.org>
Reviewed-by: Raymes Khoury <raymes@chromium.org>
Commit-Queue: Marek Haranczyk <mharanczyk@opera.com>
Cr-Commit-Position: refs/heads/master@{#629919}