Check that we've got a complete header before accessing its fields....

base/pickle_unittest.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <string>
 
 #include "base/basictypes.h"
 #include "base/pickle.h"
 #include "base/scoped_ptr.h"
 #include "base/string16.h"
@@ skipping 153 matching lines @@
   EXPECT_TRUE(pickle.WriteString("Domo"));
 
   const char* start = reinterpret_cast<const char*>(pickle.data());
   const char* end = start + pickle.size();
 
   EXPECT_TRUE(end == Pickle::FindNext(pickle.header_size_, start, end));
   EXPECT_TRUE(NULL == Pickle::FindNext(pickle.header_size_, start, end - 1));
   EXPECT_TRUE(end == Pickle::FindNext(pickle.header_size_, start, end + 1));
 }
 
+TEST(PickleTest, FindNextWithIncompleteHeader) {
+  size_t header_size = sizeof(Pickle::Header);
+  scoped_array<char> buffer(new char[header_size - 1]);
+  memset(buffer.get(), 0x1, header_size - 1);
+
+  const char* start = buffer.get();
+  const char* end = start + header_size - 1;
+
+  EXPECT_TRUE(NULL == Pickle::FindNext(header_size, start, end));
+}
+
 TEST(PickleTest, IteratorHasRoom) {
   Pickle pickle;
   EXPECT_TRUE(pickle.WriteInt(1));
   EXPECT_TRUE(pickle.WriteInt(2));
 
   const void* iter = 0;
   EXPECT_FALSE(pickle.IteratorHasRoomFor(iter, 1));
   iter = pickle.payload();
   EXPECT_TRUE(pickle.IteratorHasRoomFor(iter, 0));
   EXPECT_TRUE(pickle.IteratorHasRoomFor(iter, 1));
@@ skipping 115 matching lines @@
   EXPECT_TRUE(pickle.WriteBytes(&data, sizeof(data)));
 
   void* iter = NULL;
   const char* outdata_char;
   EXPECT_TRUE(pickle.ReadBytes(&iter, &outdata_char, sizeof(data)));
 
   int outdata;
   memcpy(&outdata, outdata_char, sizeof(outdata));
   EXPECT_EQ(data, outdata);
 }