Adding checks to guard against buffer overruns in QuotaFileIO::Write and base::FileUtilProxy::Write

ppapi/c/ppb_file_io.h

 /* Copyright (c) 2011 The Chromium Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 /* From ppb_file_io.idl modified Wed Jul 13 16:41:25 2011. */
 
 #ifndef PPAPI_C_PPB_FILE_IO_H_
 #define PPAPI_C_PPB_FILE_IO_H_
 
@@ skipping 146 matching lines @@
    *
    * @param[in] file_io A <code>PP_Resource</code> corresponding to a file
    * FileIO.
    * @param[in] offset The offset into the file.
    * @param[in] buffer The buffer to hold the specified number of bytes read.
    * @param[in] bytes_to_read The number of bytes to read from
    * <code>offset</code>.
    * @param[in] callback A <code>PP_CompletionCallback</code> to be called upon
    * completion of Read().
    *
-   * @return An The number of bytes read an error code from
+   * @return An The number of bytes read or an error code from
    * <code>pp_errors.h</code>. If the return value is 0, then end-of-file was
    * reached. It is valid to call Read() multiple times with a completion
    * callback to queue up parallel reads from the file at different offsets.
    */
   int32_t (*Read)(PP_Resource file_io,
                   int64_t offset,
                   char* buffer,
                   int32_t bytes_to_read,
                   struct PP_CompletionCallback callback);
   /**
    * Write() writes to an offset in the file.  This function might perform a
    * partial write. The FileIO object must have been opened with write access.
    *
    * @param[in] file_io A <code>PP_Resource</code> corresponding to a file
    * FileIO.
    * @param[in] offset The offset into the file.
    * @param[in] buffer The buffer to hold the specified number of bytes read.
    * @param[in] bytes_to_write The number of bytes to write to
    * <code>offset</code>.
    * @param[in] callback A <code>PP_CompletionCallback</code> to be called upon
    * completion of Write().
    *
    * @return An The number of bytes written or an error code from
    * <code>pp_errors.h</code>. If the return value is 0, then end-of-file was
    * reached. It is valid to call Write() multiple times with a completion
-   * callback to queue up parallel writes to the file at different offsets.
+   * callback to queue up parallel writes to the file at different offsets.  If
+   * bytes_to_write is less than or equal to zero, return value is
+   * PP_ERROR_FAILED.

[noelallen_use_chromium, 2011/08/17 18:56:10]

These changes will be lost on the next generation.

    */
   int32_t (*Write)(PP_Resource file_io,
                    int64_t offset,
                    const char* buffer,
                    int32_t bytes_to_write,
                    struct PP_CompletionCallback callback);
   /**
    * SetLength() sets the length of the file.  If the file size is extended,
    * then the extended area of the file is zero-filled.  The FileIO object must
    * have been opened with write access.
@@ skipping 32 matching lines @@
    * @param[in] file_io A <code>PP_Resource</code> corresponding to a file
    * FileIO.
    */
   void (*Close)(PP_Resource file_io);
 };
 /**
  * @}
  */
 
 #endif  /* PPAPI_C_PPB_FILE_IO_H_ */
-