Adding checks to guard against buffer overruns in QuotaFileIO::Write and base::FileUtilProxy::Write

webkit/plugins/ppapi/quota_file_io.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef WEBKIT_PLUGINS_PPAPI_QUOTA_FILE_IO_H_
 #define WEBKIT_PLUGINS_PPAPI_QUOTA_FILE_IO_H_
 
 #include <deque>
 
 #include "base/file_util_proxy.h"
@@ skipping 17 matching lines @@
   typedef base::FileUtilProxy::StatusCallback StatusCallback;
 
   QuotaFileIO(PluginInstance* instance,
               base::PlatformFile file,
               const GURL& path_url,
               PP_FileSystemType type);
   ~QuotaFileIO();
 
   // Performs write or setlength operation with quota checks.
   // Returns true when the operation is successfully dispatched.
+  // |bytes_to_write| must be geater than zero.
   // |callback| will be dispatched when the operation completes.
   // Otherwise it returns false and |callback| will not be dispatched.
   // |callback| will not be dispatched either when this instance is
   // destroyed before the operation completes.
   // SetLength/WillSetLength cannot be called while there're any inflight
   // operations.  For Write/WillWrite it is guaranteed that |callback| are
   // always dispatched in the same order as Write being called.
   bool Write(int64_t offset,
              const char* buffer,
              int32_t bytes_to_write,
@@ skipping 50 matching lines @@
   int inflight_operations_;
 
   base::ScopedCallbackFactory<QuotaFileIO> callback_factory_;
   DISALLOW_COPY_AND_ASSIGN(QuotaFileIO);
 };
 
 }  // namespace ppapi
 }  // namespace webkit
 
 #endif  // WEBKIT_PLUGINS_PPAPI_QUOTA_FILE_IO_H_