Adding checks to guard against buffer overruns in QuotaFileIO::Write and base::FileUtilProxy::Write

webkit/plugins/ppapi/quota_file_io.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/plugins/ppapi/quota_file_io.h"
 
+#include <algorithm>
+
 #include "base/stl_util.h"
 #include "base/message_loop_proxy.h"
 #include "base/task.h"
 #include "webkit/plugins/ppapi/ppapi_plugin_instance.h"
 
 using base::PlatformFile;
 using base::PlatformFileError;
 using quota::StorageType;
 
 namespace webkit {
@@ skipping 198 matching lines @@
   // Note that this doesn't dispatch pending callbacks.
   STLDeleteContainerPointers(pending_operations_.begin(),
                              pending_operations_.end());
   STLDeleteContainerPointers(pending_callbacks_.begin(),
                              pending_callbacks_.end());
 }
 
 bool QuotaFileIO::Write(
     int64_t offset, const char* buffer, int32_t bytes_to_write,
     WriteCallback* callback) {
+  if (bytes_to_write <= 0)
+    return false;
   WriteOperation* op = new WriteOperation(
       this, false, offset, buffer, bytes_to_write, callback);
   return RegisterOperationForQuotaChecks(op);
 }
 
 bool QuotaFileIO::SetLength(int64_t length, StatusCallback* callback) {
   DCHECK(pending_operations_.empty());
   SetLengthOperation* op = new SetLengthOperation(
       this, false, length, callback);
   return RegisterOperationForQuotaChecks(op);
@@ skipping 118 matching lines @@
   pending_callbacks_.pop_front();
   DCHECK(pending_callbacks_.empty());
   int64_t delta = (error != base::PLATFORM_FILE_OK) ? 0 :
       new_file_size - cached_file_size_;
   instance_->delegate()->DidUpdateFile(file_url_, delta);
   inflight_operations_ = 0;
 }
 
 }  // namespace ppapi
 }  // namespace webkit