Apply a sanity limit to objects with width & height.

chrome/common/common_param_traits.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/common_param_traits.h"
 
 #include "chrome/common/chrome_constants.h"
 #include "gfx/rect.h"
 #include "googleurl/src/gurl.h"
 #ifndef EXCLUDE_SKIA_DEPENDENCIES
@@ skipping 129 matching lines @@
   m->WriteInt(p.height());
 }
 
 bool ParamTraits<gfx::Rect>::Read(const Message* m, void** iter, gfx::Rect* r) {
   int x, y, w, h;
   if (!m->ReadInt(iter, &x) ||
       !m->ReadInt(iter, &y) ||
       !m->ReadInt(iter, &w) ||
       !m->ReadInt(iter, &h))
     return false;
+  if (x < 0 || y < 0 || x >= (INT_MAX - w) || y >= (INT_MAX - h) ||
+      w < 0 || h < 0 || h >= ((INT_MAX / 16) / (w ? w : 1)))
+    return false;
   r->set_x(x);
   r->set_y(y);
   r->set_width(w);
   r->set_height(h);
   return true;
 }
 
 void ParamTraits<gfx::Rect>::Log(const gfx::Rect& p, std::wstring* l) {
   l->append(StringPrintf(L"(%d, %d, %d, %d)", p.x(), p.y(),
                          p.width(), p.height()));
 }
 
 
 void ParamTraits<gfx::Size>::Write(Message* m, const gfx::Size& p) {
   m->WriteInt(p.width());
   m->WriteInt(p.height());
 }
 
 bool ParamTraits<gfx::Size>::Read(const Message* m, void** iter, gfx::Size* r) {
   int w, h;
   if (!m->ReadInt(iter, &w) ||
       !m->ReadInt(iter, &h))
     return false;
+  if (w < 0 || h < 0 || h >= ((INT_MAX / 16) / (w ? w : 1)))
+    return false;
   r->set_width(w);
   r->set_height(h);
   return true;
 }
 
 void ParamTraits<gfx::Size>::Log(const gfx::Size& p, std::wstring* l) {
   l->append(StringPrintf(L"(%d, %d)", p.width(), p.height()));
 }
 
 void ParamTraits<ContentSettings>::Write(
@@ skipping 113 matching lines @@
           L"%.6f %.6f %.6f ",
           p.latitude, p.longitude, p.accuracy, p.altitude,
           p.altitude_accuracy, p.speed, p.heading));
   LogParam(p.timestamp, l);
   l->append(L" ");
   l->append(p.error_message);
   LogParam(p.error_code, l);
 }
 
 }  // namespace IPC