WebSocketFrameChunk should use IOBuffer to hold data

net/websockets/websocket_frame_parser.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/websockets/websocket_frame_parser.h"
 
 #include <algorithm>
+#include <limits>
 
 #include "base/basictypes.h"
 #include "base/logging.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/scoped_vector.h"
 #include "net/base/big_endian.h"
+#include "net/base/io_buffer.h"
 #include "net/websockets/websocket_frame.h"
 
 namespace {
 
 const uint8 kFinalBit = 0x80;
 const uint8 kReserved1Bit = 0x40;
 const uint8 kReserved2Bit = 0x20;
 const uint8 kReserved3Bit = 0x10;
 const uint8 kOpCodeMask = 0xF;
 const uint8 kMaskBit = 0x80;
@@ skipping 88 matching lines @@
 
   bool final = (first_byte & kFinalBit) != 0;
   bool reserved1 = (first_byte & kReserved1Bit) != 0;
   bool reserved2 = (first_byte & kReserved2Bit) != 0;
   bool reserved3 = (first_byte & kReserved3Bit) != 0;
   OpCode opcode = first_byte & kOpCodeMask;
 
   bool masked = (second_byte & kMaskBit) != 0;
   uint64 payload_length = second_byte & kPayloadLengthMask;
   bool valid_length_format = true;
+  bool message_too_big = false;
   if (payload_length == kPayloadLengthWithTwoByteExtendedLengthField) {
     if (end - current < 2)
       return;
     uint16 payload_length_16;
     ReadBigEndian(current, &payload_length_16);
     current += 2;
     payload_length = payload_length_16;
     if (payload_length <= kMaxPayloadLengthWithoutExtendedLengthField)
       valid_length_format = false;
   } else if (payload_length == kPayloadLengthWithEightByteExtendedLengthField) {
     if (end - current < 8)
       return;
     ReadBigEndian(current, &payload_length);
     current += 8;
     if (payload_length <= kuint16max ||
         payload_length > static_cast<uint64>(kint64max)) {
       valid_length_format = false;
     }
+    if (payload_length > static_cast<uint64>(kint32max))
+      message_too_big = true;
   }
-  if (!valid_length_format) {
+  if (!valid_length_format || message_too_big) {
     failed_ = true;
     buffer_.clear();
     current_read_pos_ = 0;
     current_frame_header_.reset();
     frame_offset_ = 0;
     return;
   }
 
   if (masked) {
     if (end - current < kMaskingKeyLength)
@@ skipping 18 matching lines @@
 
 scoped_ptr<WebSocketFrameChunk> WebSocketFrameParser::DecodeFramePayload(
     bool first_chunk) {
   static const int kMaskingKeyLength = WebSocketFrameHeader::kMaskingKeyLength;
 
   const char* current = &buffer_.front() + current_read_pos_;
   const char* end = &buffer_.front() + buffer_.size();
   uint64 next_size = std::min<uint64>(
       end - current,
       current_frame_header_->payload_length - frame_offset_);
+  // This check must pass because |payload_length| is already checked to be
+  // less than std::numeric_limits<int>::max() when the header is parsed.
+  DCHECK_LE(next_size, static_cast<uint64>(kint32max));
 
   scoped_ptr<WebSocketFrameChunk> frame_chunk(new WebSocketFrameChunk);
   if (first_chunk) {
     frame_chunk->header.reset(new WebSocketFrameHeader(*current_frame_header_));
   }
   frame_chunk->final_chunk = false;
-  frame_chunk->data.assign(current, current + next_size);
-  if (current_frame_header_->masked) {
-    // Unmask the payload.
-    // TODO(yutak): This could be faster by doing unmasking for each
-    // machine word (instead of each byte).
-    size_t key_offset = frame_offset_ % kMaskingKeyLength;
-    for (uint64 i = 0; i < next_size; ++i) {
-      frame_chunk->data[i] ^= masking_key_[key_offset];
-      key_offset = (key_offset + 1) % kMaskingKeyLength;
+  if (next_size) {
+    frame_chunk->data = new IOBufferWithSize(static_cast<int>(next_size));
+    char* io_data = frame_chunk->data->data();
+    memcpy(io_data, current, next_size);
+    if (current_frame_header_->masked) {
+      // Unmask the payload.
+      // TODO(yutak): This could be faster by doing unmasking for each
+      // machine word (instead of each byte).
+      size_t key_offset = frame_offset_ % kMaskingKeyLength;
+      for (uint64 i = 0; i < next_size; ++i) {
+        io_data[i] ^= masking_key_[key_offset];
+        key_offset = (key_offset + 1) % kMaskingKeyLength;
+      }
     }
+
+    current_read_pos_ += next_size;
+    frame_offset_ += next_size;
   }
 
-  current_read_pos_ += next_size;
-  frame_offset_ += next_size;
-
   DCHECK_LE(frame_offset_, current_frame_header_->payload_length);
   if (frame_offset_ == current_frame_header_->payload_length) {
     frame_chunk->final_chunk = true;
     current_frame_header_.reset();
     frame_offset_ = 0;
   }
 
   return frame_chunk.Pass();
 }
 
 }  // namespace net