Sbox IPC fix

sandbox/src/ipc_unittest.cc

 // Copyright (c) 2006-2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/basictypes.h"
 #include "sandbox/src/crosscall_client.h"
 #include "sandbox/src/crosscall_server.h"
 #include "sandbox/src/sharedmem_ipc_client.h"
 #include "sandbox/src/sharedmem_ipc_server.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ skipping 314 matching lines @@
     params_2.CopyParamIn(0, &value, sizeof(value), false, ULONG_TYPE);
     buffer = const_cast<void*>(params_2.GetBuffer());
 
     EXPECT_TRUE(NULL != buffer);
     ccp = CrossCallParamsEx::CreateFromBuffer(buffer, params_2.GetSize(),
                                               &out_size);
     // If the buffer is malformed the return is NULL.
     EXPECT_TRUE(NULL == ccp);
   }
 #endif  // defined(NDEBUG)
+
+  ActualCallParams<1, 256> params_3(kTag, 1);
+  params_3.CopyParamIn(0, &value, sizeof(value), false, ULONG_TYPE);
+  buffer = const_cast<void*>(params_3.GetBuffer());
+  EXPECT_TRUE(NULL != buffer);
+
+  size_t correct_size = params_3.OverrideSize(1);
+  ccp = CrossCallParamsEx::CreateFromBuffer(buffer, 256, &out_size);
+  EXPECT_TRUE(NULL == ccp);
+
+  params_3.OverrideSize(correct_size - 4);
+  ccp = CrossCallParamsEx::CreateFromBuffer(buffer, 256, &out_size);
+  EXPECT_TRUE(NULL == ccp);
+
+  params_3.OverrideSize(correct_size);
+  ccp = CrossCallParamsEx::CreateFromBuffer(buffer, 256, &out_size);
+  EXPECT_TRUE(NULL != ccp);
 }
 
 // This structure is passed to the mock server threads to simulate
 // the server side IPC so it has the required kernel objects.
 struct ServerEvents {
   HANDLE ping;
   HANDLE pong;
   volatile LONG* state;
   HANDLE mutex;
 };
@@ skipping 251 matching lines @@
                                                  &call_return));
   EXPECT_EQ(SBOX_ALL_OK, call_return.call_outcome);
   EXPECT_TRUE(bar == call_return.extended[0].handle);
   EXPECT_EQ(foo, call_return.extended[1].unsigned_int);
 
   CloseChannelEvents(client_control);
   delete[] reinterpret_cast<char*>(client_control);
 }
 
 }  // namespace sandbox