IPC: defend against excessive number of submenu entries in PPAPI message.

ppapi/proxy/serialized_flash_menu.cc

Index: ppapi/proxy/serialized_flash_menu.cc
===================================================================
--- ppapi/proxy/serialized_flash_menu.cc	(revision 174890)
+++ ppapi/proxy/serialized_flash_menu.cc	(working copy)
@@ -15,6 +15,7 @@
 // Maximum depth of submenus allowed (e.g., 1 indicates that submenus are
 // allowed, but not sub-submenus).
 const int kMaxMenuDepth = 2;
+const uint32_t kMaxMenuEntries = 1000;
 
 bool CheckMenu(int depth, const PP_Flash_Menu* menu);
 void FreeMenu(const PP_Flash_Menu* menu);
@@ -123,6 +124,11 @@
   if (menu->count == 0)
     return menu;
 
+  if (menu->count > kMaxMenuEntries) {
+    FreeMenu(menu);
+    return NULL;
+  }
+
   menu->items = new PP_Flash_MenuItem[menu->count];
   memset(menu->items, 0, sizeof(PP_Flash_MenuItem) * menu->count);
   for (uint32_t i = 0; i < menu->count; ++i) {