Merge 36923 - Fix integer overflow in sbox...

sandbox/src/crosscall_params.h

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_SRC_CROSSCALL_PARAMS_H__
 #define SANDBOX_SRC_CROSSCALL_PARAMS_H__
 
 #include <windows.h>
 #include <lmaccess.h>
 
@@ skipping 184 matching lines @@
 // between one parameter and the next down
 template <size_t NUMBER_PARAMS, size_t BLOCK_SIZE>
 class ActualCallParams : public CrossCallParams {
  public:
   // constructor. Pass the ipc unique tag as input
   explicit ActualCallParams(uint32 tag)
       : CrossCallParams(tag, NUMBER_PARAMS) {
     param_info_[0].offset_ = parameters_ - reinterpret_cast<char*>(this);
   }
 
+  // Testing-only constructor. Allows setting the |number_params| to a
+  // wrong value.
+  ActualCallParams(uint32 tag, uint32 number_params)
+      : CrossCallParams(tag, number_params) {
+    param_info_[0].offset_ = parameters_ - reinterpret_cast<char*>(this);
+  }
+
   // Copies each paramter into the internal buffer. For each you must supply:
   // index: 0 for the first param, 1 for the next an so on
   bool CopyParamIn(size_t index, const void* parameter_address, size_t size,
                    bool is_in_out, ArgType type) {
     if (index >= NUMBER_PARAMS) {
       return false;
     }
 
     if (kuint32max == size) {
       // Memory error while getting the size.
@@ skipping 53 matching lines @@
   DISALLOW_EVIL_CONSTRUCTORS(ActualCallParams);
 };
 
 COMPILE_ASSERT(sizeof(ActualCallParams<1, 1024>) == 1024, bad_size_buffer);
 COMPILE_ASSERT(sizeof(ActualCallParams<2, 1024>) == 1024, bad_size_buffer);
 COMPILE_ASSERT(sizeof(ActualCallParams<3, 1024>) == 1024, bad_size_buffer);
 
 }  // namespace sandbox
 
 #endif  // SANDBOX_SRC_CROSSCALL_PARAMS_H__