Adding checks to guard against buffer overruns in QuotaFileIO::Write and base::FileUtilProxy::Write

webkit/plugins/ppapi/quota_file_io_unittest.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <deque>
+#include <limits>
+#include <string>
 
 #include "base/basictypes.h"
 #include "base/memory/scoped_callback_factory.h"
 #include "base/message_loop.h"
 #include "base/platform_file.h"
 #include "base/scoped_temp_dir.h"
 #include "base/task.h"
 #include "webkit/plugins/ppapi/mock_plugin_delegate.h"
 #include "webkit/plugins/ppapi/ppapi_unittest.h"
 #include "webkit/plugins/ppapi/quota_file_io.h"
@@ skipping 92 matching lines @@
       base::ClosePlatformFile(file_);
     PpapiUnittest::TearDown();
   }
 
  protected:
   virtual MockPluginDelegate* NewPluginDelegate() OVERRIDE {
     return static_cast<MockPluginDelegate*>(new QuotaMockPluginDelegate);
   }
 
   void WriteTestBody(bool will_operation) {
+    // Attempt to write zero bytes.
+    EXPECT_FALSE(quota_file_io_->Write(0, "data", 0,
+                                       callback_factory_.NewCallback(
+                                           &QuotaFileIOTest::DidWrite)));
+    // Attempt to write negative number of bytes.
+    EXPECT_FALSE(quota_file_io_->Write(0, "data",
+                                       std::numeric_limits<int32_t>::min(),
+                                       callback_factory_.NewCallback(
+                                           &QuotaFileIOTest::DidWrite)));
+
     quota_plugin_delegate()->set_available_space(100);
     std::string read_buffer;
 
     // Write 8 bytes at offset 0 (-> length=8).
     std::string data("12345678");
     Write(0, data, will_operation);
     MessageLoop::current()->RunAllPending();
     ASSERT_EQ(1U, num_results());
     EXPECT_EQ(static_cast<int>(data.size()), bytes_written().front());
     EXPECT_EQ(base::PLATFORM_FILE_OK, status().front());
@@ skipping 351 matching lines @@
   pop_result();
 
   EXPECT_EQ(22 - 15, quota_plugin_delegate()->available_space());
   EXPECT_EQ(15, GetPlatformFileSize());
   ReadPlatformFile(&read_buffer);
   EXPECT_EQ("123355559012345", read_buffer);
 }
 
 }  // namespace ppapi
 }  // namespace webkit