Fix a couple of integer issues in Pickle deserialization

base/pickle.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/pickle.h"
 
 #include <stdlib.h>
 
 #include <limits>
 #include <string>
@@ skipping 190 matching lines @@
   UpdateIter(iter, len);
   return true;
 }
 
 bool Pickle::ReadWString(void** iter, std::wstring* result) const {
   DCHECK(iter);
 
   int len;
   if (!ReadLength(iter, &len))
     return false;
+  // Avoid integer overflow.
+  if (len > INT_MAX / static_cast<int>(sizeof(wchar_t)))
+    return false;
   if (!IteratorHasRoomFor(*iter, len * sizeof(wchar_t)))
     return false;
 
   wchar_t* chars = reinterpret_cast<wchar_t*>(*iter);
   result->assign(chars, len);
 
   UpdateIter(iter, len * sizeof(wchar_t));
   return true;
 }
 
 bool Pickle::ReadString16(void** iter, string16* result) const {
   DCHECK(iter);
 
   int len;
   if (!ReadLength(iter, &len))
     return false;
-  if (!IteratorHasRoomFor(*iter, len))
+  if (!IteratorHasRoomFor(*iter, len * sizeof(char16)))
     return false;
 
   char16* chars = reinterpret_cast<char16*>(*iter);
   result->assign(chars, len);
 
   UpdateIter(iter, len * sizeof(char16));
   return true;
 }
 
 bool Pickle::ReadBytes(void** iter, const char** data, int length) const {
@@ skipping 141 matching lines @@
   DCHECK(header_size <= static_cast<size_t>(kPayloadUnit));
 
   const Header* hdr = reinterpret_cast<const Header*>(start);
   const char* payload_base = start + header_size;
   const char* payload_end = payload_base + hdr->payload_size;
   if (payload_end < payload_base)
     return NULL;
 
   return (payload_end > end) ? NULL : payload_end;
 }