Merge 36923 - Fix integer overflow in sbox...

sandbox/src/crosscall_server.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <string>
 #include <vector>
 
 #include "sandbox/src/crosscall_server.h"
 #include "sandbox/src/crosscall_params.h"
 #include "sandbox/src/crosscall_client.h"
 #include "base/logging.h"
 
 // This code performs the ipc message validation. Potential security flaws
 // on the ipc are likelier to be found in this code than in the rest of
 // the ipc code.
 
 namespace {
   // The buffer for a message must match the max channel size.
   const size_t kMaxBufferSize = sandbox::kIPCChannelSize;
 }
 
 namespace sandbox {
 
-// Returns the actual size for the parameters in an IPC buffer.
-void GetActualBufferSize(size_t param_count, void* buffer_base,
-                         size_t* actual_size) {
+// Returns the actual size for the parameters in an IPC buffer. Returns
+// zero if the |param_count| is zero or too big.
+size_t GetActualBufferSize(size_t param_count, void* buffer_base) {
   // The template types are used to calculate the maximum expected size.
   typedef ActualCallParams<1, kMaxBufferSize> ActualCP1;
   typedef ActualCallParams<2, kMaxBufferSize> ActualCP2;
   typedef ActualCallParams<3, kMaxBufferSize> ActualCP3;
   typedef ActualCallParams<4, kMaxBufferSize> ActualCP4;
   typedef ActualCallParams<5, kMaxBufferSize> ActualCP5;
   typedef ActualCallParams<6, kMaxBufferSize> ActualCP6;
   typedef ActualCallParams<7, kMaxBufferSize> ActualCP7;
   typedef ActualCallParams<8, kMaxBufferSize> ActualCP8;
   typedef ActualCallParams<9, kMaxBufferSize> ActualCP9;
 
   // Retrieve the actual size and the maximum size of the params buffer.
   switch (param_count) {
+    case 0:
+      return 0;
     case 1:
-      *actual_size = reinterpret_cast<ActualCP1*>(buffer_base)->GetSize();
-      break;
+      return reinterpret_cast<ActualCP1*>(buffer_base)->GetSize();
     case 2:
-      *actual_size = reinterpret_cast<ActualCP2*>(buffer_base)->GetSize();
-      break;
+      return reinterpret_cast<ActualCP2*>(buffer_base)->GetSize();
     case 3:
-      *actual_size = reinterpret_cast<ActualCP3*>(buffer_base)->GetSize();
-      break;
+      return reinterpret_cast<ActualCP3*>(buffer_base)->GetSize();
     case 4:
-      *actual_size = reinterpret_cast<ActualCP4*>(buffer_base)->GetSize();
-      break;
+      return reinterpret_cast<ActualCP4*>(buffer_base)->GetSize();
     case 5:
-      *actual_size = reinterpret_cast<ActualCP5*>(buffer_base)->GetSize();
-      break;
+      return reinterpret_cast<ActualCP5*>(buffer_base)->GetSize();
     case 6:
-      *actual_size = reinterpret_cast<ActualCP6*>(buffer_base)->GetSize();
-      break;
+      return reinterpret_cast<ActualCP6*>(buffer_base)->GetSize();
     case 7:
-      *actual_size = reinterpret_cast<ActualCP7*>(buffer_base)->GetSize();
-      break;
+      return reinterpret_cast<ActualCP7*>(buffer_base)->GetSize();
     case 8:
-      *actual_size = reinterpret_cast<ActualCP8*>(buffer_base)->GetSize();
-      break;
+      return reinterpret_cast<ActualCP8*>(buffer_base)->GetSize();
     case 9:
-      *actual_size = reinterpret_cast<ActualCP9*>(buffer_base)->GetSize();
-      break;
+      return reinterpret_cast<ActualCP9*>(buffer_base)->GetSize();
     default:
       NOTREACHED();
-      *actual_size = 0;
+      return 0;
   }
 }
 
 CrossCallParamsEx::CrossCallParamsEx()
   :CrossCallParams(0, 0) {
 }
 
 // We override the delete operator because the object's backing memory
 // is hand allocated in CreateFromBuffer. We don't override the new operator
 // because the constructors are private so there is no way to mismatch
@@ skipping 17 matching lines @@
   }
   if (buffer_size < sizeof(CrossCallParams)) {
     return NULL;
   }
   if (buffer_size > kMaxBufferSize) {
     return NULL;
   }
   char* backing_mem = NULL;
   size_t param_count = 0;
   CrossCallParamsEx* copied_params = NULL;
-
-  size_t actual_size = 0;
+  size_t actual_size;
 
   // Touching the untrusted buffer is done under a SEH try block. This
   // will catch memory access violations so we don't crash.
   __try {
     CrossCallParams* call_params =
         reinterpret_cast<CrossCallParams*>(buffer_base);
     // Check against the minimum size given the number of stated params
     // if too small we bail out.
     param_count = call_params->GetParamsCount();
     if ((buffer_size - sizeof(CrossCallParams)) <
         (sizeof(ptrdiff_t) * (param_count + 1))) {
-      // Too small.
+      // This test is subject to integer overflow but the next is not.
       return NULL;
     }
 
-    GetActualBufferSize(param_count, buffer_base, &actual_size);
-
-    if (actual_size > buffer_size) {
-      // It is too big.
+    actual_size = GetActualBufferSize(param_count, buffer_base);
+    if ((actual_size > buffer_size) || (0 == actual_size)) {
+      // It is too big or too many declared parameters.
       return NULL;
     }
+
     // Now we copy the actual amount of the message.
     actual_size += sizeof(ParamInfo);  // To get the last offset.
     *output_size = actual_size;
     backing_mem = new char[actual_size];
     memset(backing_mem, 0, actual_size);
     // Note that this is a placement new.
 #pragma warning(push)
 #pragma warning(disable: 4291)  // No matching operator delete.
     // TODO(cpu): Remove this warning.
     copied_params = new(backing_mem)CrossCallParamsEx();
@@ skipping 113 matching lines @@
   for (; it != ipc_calls_.end(); ++it) {
     if (it->params.Matches(ipc)) {
       *callback = it->callback;
       return this;
     }
   }
   return NULL;
 }
 
 }  // namespace sandbox