Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(159)

Issue 4723007: SandboxedExtensionUnpacker::ValidateSignature should check for an empty signa... (Closed)

Created:
10 years, 1 month ago by jschuh
Modified:
9 years, 6 months ago
CC:
chromium-reviews, Aaron Boodman, Erik does not do reviews, pam+watch_chromium.org, ben+cc_chromium.org
Visibility:
Public.

Description

SandboxedExtensionUnpacker::ValidateSignature should check for an empty signature Without an expicit check we crash on a hard int3 when trying to allocate 0 bytes. BUG=62791 TEST=None. Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=65821

Patch Set 1 #

Unified diffs Side-by-side diffs Delta from patch set Stats (+4 lines, -0 lines) Patch
M chrome/browser/extensions/sandboxed_extension_unpacker.cc View 1 chunk +4 lines, -0 lines 0 comments Download

Messages

Total messages: 2 (0 generated)
jschuh
Simple fix for a report we got this morning.
10 years, 1 month ago (2010-11-11 17:13:51 UTC) #1
Erik does not do reviews
10 years, 1 month ago (2010-11-11 17:28:04 UTC) #2
LGTM.  thanks.

On Thu, Nov 11, 2010 at 9:13 AM, <jschuh@chromium.org> wrote:

> Reviewers: aa.chromium, Erik Kay,
>
> Message:
> Simple fix for a report we got this morning.
>
> Description:
> SandboxedExtensionUnpacker::ValidateSignature should check for an empty
> signature
>
> Without an expicit check we crash on a hard int3 when trying to allocate 0
> bytes.
>
> BUG=62791
> TEST=None.
>
> Please review this at http://codereview.chromium.org/4723007/
>
> SVN Base: svn://chrome-svn/chrome/trunk/src/
>
> Affected files:
>  M     chrome/browser/extensions/sandboxed_extension_unpacker.cc
>
>
> Index: chrome/browser/extensions/sandboxed_extension_unpacker.cc
> ===================================================================
> --- chrome/browser/extensions/sandboxed_extension_unpacker.cc   (revision
> 65541)
> +++ chrome/browser/extensions/sandboxed_extension_unpacker.cc   (working
> copy)
> @@ -228,6 +228,10 @@
>     ReportFailure("Key length is zero");
>     return false;
>   }
> +  if (header.signature_size == 0) {
> +    ReportFailure("Signature length is zero");
> +    return false;
> +  }
>
>   std::vector<uint8> key;
>   key.resize(header.key_size);
>
>
>

Powered by Google App Engine
This is Rietveld 408576698