IPC: defend against excessive number of submenu entries in PPAPI message.

ppapi/proxy/serialized_flash_menu.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ppapi/proxy/serialized_flash_menu.h"
 
 #include "ipc/ipc_message.h"
 #include "ppapi/c/private/ppb_flash_menu.h"
 #include "ppapi/proxy/ppapi_param_traits.h"
 
 namespace ppapi {
 namespace proxy {
 
 namespace {
 // Maximum depth of submenus allowed (e.g., 1 indicates that submenus are
 // allowed, but not sub-submenus).
 const int kMaxMenuDepth = 2;
+const uint32_t kMaxMenuEntries = 1000;
 
 bool CheckMenu(int depth, const PP_Flash_Menu* menu);
 void FreeMenu(const PP_Flash_Menu* menu);
 void WriteMenu(IPC::Message* m, const PP_Flash_Menu* menu);
 PP_Flash_Menu* ReadMenu(int depth, const IPC::Message* m, PickleIterator* iter);
 
 bool CheckMenuItem(int depth, const PP_Flash_MenuItem* item) {
   if (item->type == PP_FLASH_MENUITEM_TYPE_SUBMENU)
     return CheckMenu(depth, item->submenu);
   return true;
@@ skipping 88 matching lines @@
   menu->items = NULL;
 
   if (!m->ReadUInt32(iter, &menu->count)) {
     FreeMenu(menu);
     return NULL;
   }
 
   if (menu->count == 0)
     return menu;
 
+  if (menu->count > kMaxMenuEntries) {
+    FreeMenu(menu);
+    return NULL;
+  }
+
   menu->items = new PP_Flash_MenuItem[menu->count];
   memset(menu->items, 0, sizeof(PP_Flash_MenuItem) * menu->count);
   for (uint32_t i = 0; i < menu->count; ++i) {
     if (!ReadMenuItem(depth, m, iter, menu->items + i)) {
       FreeMenu(menu);
       return NULL;
     }
   }
   return menu;
 }
@@ skipping 30 matching lines @@
   pp_menu_ = ReadMenu(0, m, iter);
   if (!pp_menu_)
     return false;
 
   own_menu_ = true;
   return true;
 }
 
 }  // namespace proxy
 }  // namespace ppapi