Merge 168937 - Verify lfFaceName is NUL terminated in IPC deserializer.

ipc/ipc_message_utils.cc

Index: ipc/ipc_message_utils.cc
===================================================================
--- ipc/ipc_message_utils.cc	(revision 170565)
+++ ipc/ipc_message_utils.cc	(working copy)
@@ -16,6 +16,8 @@
 
 #if defined(OS_POSIX)
 #include "ipc/file_descriptor_set_posix.h"
+#elif defined(OS_WIN)
+#include <tchar.h>
 #endif
 
 namespace IPC {
@@ -806,15 +808,16 @@
                                 param_type* r) {
   const char *data;
   int data_size = 0;
-  bool result = m->ReadData(iter, &data, &data_size);
-  if (result && data_size == sizeof(LOGFONT)) {
-    memcpy(r, data, sizeof(LOGFONT));
-  } else {
-    result = false;
-    NOTREACHED();
+  if (m->ReadData(iter, &data, &data_size) && data_size == sizeof(LOGFONT)) {
+    const LOGFONT *font = reinterpret_cast<LOGFONT*>(const_cast<char*>(data));
+    if (_tcsnlen(font->lfFaceName, LF_FACESIZE) < LF_FACESIZE) {
+      memcpy(r, data, sizeof(LOGFONT));
+      return true;
+    }
   }
 
-  return result;
+  NOTREACHED();
+  return false;
 }
 
 void ParamTraits<LOGFONT>::Log(const param_type& p, std::string* l) {