Check that we've got a complete header before accessing its fields....

Check that we've got a complete header before accessing its fields.

This patch was prepared by Evgeniy Stepanov (eugenis@chromium.org) and reviewed
at http://codereview.chromium.org/6353010/

BUG=70376
TEST=none
TBR=darin,willchan


Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=72634

[willchan no longer on Chromium, 2011-01-26 15:36:54]

LGTM

On Wed, Jan 26, 2011 at 5:03 AM, <glider@chromium.org> wrote:

> Reviewers: darin, willchan,
>
> Description:
> Check that we've got a complete header before accessing its fields.
>
> This patch was prepared by Evgeniy Stepanov (eugenis@chromium.org) and
> reviewed
> at http://codereview.chromium.org/6353010/
>
> BUG=70376
> TEST=none
> TBR=darin,willchan
>
>
> Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=72634
>
> Please review this at http://codereview.chromium.org/6347013/
>
> SVN Base: svn://svn.chromium.org/chrome/trunk/src/
>
> Affected files:
>  M     base/pickle.h
>  M     base/pickle.cc
>  M     base/pickle_unittest.cc
>
>
> Index: base/pickle.cc
> ===================================================================
> --- base/pickle.cc      (revision 72619)
> +++ base/pickle.cc      (working copy)
> @@ -406,6 +406,9 @@
>   DCHECK(header_size == AlignInt(header_size, sizeof(uint32)));
>   DCHECK(header_size <= static_cast<size_t>(kPayloadUnit));
>
> +  if (static_cast<size_t>(end - start) < sizeof(Header))
> +    return NULL;
> +
>   const Header* hdr = reinterpret_cast<const Header*>(start);
>   const char* payload_base = start + header_size;
>   const char* payload_end = payload_base + hdr->payload_size;
> Index: base/pickle.h
> ===================================================================
> --- base/pickle.h       (revision 72619)
> +++ base/pickle.h       (working copy)
> @@ -236,6 +236,7 @@
>
>   FRIEND_TEST_ALL_PREFIXES(PickleTest, Resize);
>   FRIEND_TEST_ALL_PREFIXES(PickleTest, FindNext);
> +  FRIEND_TEST_ALL_PREFIXES(PickleTest, FindNextWithIncompleteHeader);
>   FRIEND_TEST_ALL_PREFIXES(PickleTest, IteratorHasRoom);
>  };
>
> Index: base/pickle_unittest.cc
> ===================================================================
> --- base/pickle_unittest.cc     (revision 72619)
> +++ base/pickle_unittest.cc     (working copy)
> @@ -171,6 +171,17 @@
>   EXPECT_TRUE(end == Pickle::FindNext(pickle.header_size_, start, end +
> 1));
>  }
>
> +TEST(PickleTest, FindNextWithIncompleteHeader) {
> +  size_t header_size = sizeof(Pickle::Header);
> +  scoped_array<char> buffer(new char[header_size - 1]);
> +  memset(buffer.get(), 0x1, header_size - 1);
> +
> +  const char* start = buffer.get();
> +  const char* end = start + header_size - 1;
> +
> +  EXPECT_TRUE(NULL == Pickle::FindNext(header_size, start, end));
> +}
> +
>  TEST(PickleTest, IteratorHasRoom) {
>   Pickle pickle;
>   EXPECT_TRUE(pickle.WriteInt(1));
>
>
>