Avoid integer overflows in BlobURLRequestJob.

webkit/blob/blob_url_request_job.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/blob/blob_url_request_job.h"
 
+#include <limits>
+
 #include "base/bind.h"
 #include "base/compiler_specific.h"
 #include "base/files/file_util_proxy.h"
 #include "base/message_loop.h"
 #include "base/message_loop_proxy.h"
 #include "base/stl_util.h"
 #include "base/string_number_conversions.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
 #include "net/http/http_request_headers.h"
@@ skipping 159 matching lines @@
 
   // If the blob data is not present, bail out.
   if (!blob_data_) {
     NotifyFailure(net::ERR_FILE_NOT_FOUND);
     return;
   }
 
   CountSize();
 }
 
+bool BlobURLRequestJob::AddItemLength(size_t index, int64 item_length) {
+  if (item_length > std::numeric_limits<int64>::max() - total_size_) {

[michaeln, 2013/01/29 20:22:43]

base/basictypes.h defines some constants like this... kint64max

+    NotifyFailure(net::ERR_FAILED);
+    return false;
+  }
+
+  // Cache the size and add it to the total size.
+  DCHECK_LT(index, item_length_list_.size());
+  item_length_list_[index] = item_length;
+  total_size_ += item_length;
+  return true;
+}
+
 void BlobURLRequestJob::CountSize() {
   error_ = false;
   pending_get_file_info_count_ = 0;
   total_size_ = 0;
   item_length_list_.resize(blob_data_->items().size());
 
   for (size_t i = 0; i < blob_data_->items().size(); ++i) {
     const BlobData::Item& item = blob_data_->items().at(i);
     if (IsFileType(item.type())) {
       ++pending_get_file_info_count_;
       GetFileStreamReader(i)->GetLength(
           base::Bind(&BlobURLRequestJob::DidGetFileItemLength,
                      weak_factory_.GetWeakPtr(), i));
       continue;
     }
-    // Cache the size and add it to the total size.
-    int64 item_length = static_cast<int64>(item.length());
-    item_length_list_[i] = item_length;
-    total_size_ += item_length;
+
+    if (!AddItemLength(i, item.length()))
+      return;
   }
 
   if (pending_get_file_info_count_ == 0)
     DidCountSize(net::OK);
 }
 
 void BlobURLRequestJob::DidCountSize(int error) {
   DCHECK(!error_);
 
   // If an error occured, bail out.
@@ skipping 29 matching lines @@
     return;
   } else if (result < 0) {
     NotifyFailure(result);
     return;
   }
 
   DCHECK_LT(index, blob_data_->items().size());
   const BlobData::Item& item = blob_data_->items().at(index);
   DCHECK(IsFileType(item.type()));
 
+  uint64 file_length = result;
+  uint64 item_offset = item.offset();
+  uint64 item_length = item.length();
+
+  if (item_offset > file_length) {
+    NotifyFailure(net::ERR_FILE_NOT_FOUND);
+    return;
+  }
+
+  uint64 max_length = file_length - item_offset;
+
   // If item length is -1, we need to use the file size being resolved
   // in the real time.
-  int64 item_length = static_cast<int64>(item.length());
-  if (item_length == -1)
-    item_length = result - item.offset();
+  if (item_length == static_cast<uint64>(-1)) {
+    item_length = max_length;
+  } else if (item_length > max_length) {
+    NotifyFailure(net::ERR_FILE_NOT_FOUND);
+    return;
+  }
 
-  // Cache the size and add it to the total size.
-  DCHECK_LT(index, item_length_list_.size());
-  item_length_list_[index] = item_length;
-  total_size_ += item_length;
+  if (!AddItemLength(index, item_length))
+    return;
 
   if (--pending_get_file_info_count_ == 0)
     DidCountSize(net::OK);
 }
 
 void BlobURLRequestJob::Seek(int64 offset) {
   // Skip the initial items that are not in the range.
   for (current_item_index_ = 0;
        current_item_index_ < blob_data_->items().size() &&
            offset >= item_length_list_[current_item_index_];
@@ skipping 139 matching lines @@
   }
 }
 
 int BlobURLRequestJob::BytesReadCompleted() {
   int bytes_read = read_buf_->BytesConsumed();
   read_buf_ = NULL;
   return bytes_read;
 }
 
 int BlobURLRequestJob::ComputeBytesToRead() const {
-  int64 current_item_remaining_bytes =
-      item_length_list_[current_item_index_] - current_item_offset_;
-  int64 remaining_bytes = std::min(current_item_remaining_bytes,
-                                   remaining_bytes_);
+  int64 current_item_length = item_length_list_[current_item_index_];
 
-  return static_cast<int>(std::min(
-             static_cast<int64>(read_buf_->BytesRemaining()),
-             remaining_bytes));
+  int64 item_remaining = current_item_length - current_item_offset_;
+  int64 buf_remaining = read_buf_->BytesRemaining();
+  int64 max_remaining = std::numeric_limits<int>::max();
+
+  int64 min = std::min(std::min(std::min(item_remaining,
+                                         buf_remaining),
+                                         remaining_bytes_),
+                                         max_remaining);
+
+  return static_cast<int>(min);
 }
 
 bool BlobURLRequestJob::ReadLoop(int* bytes_read) {
   // Read until we encounter an error or could not get the data immediately.
   while (remaining_bytes_ > 0 && read_buf_->BytesRemaining() > 0) {
     if (!ReadItem())
       return false;
   }
 
   *bytes_read = BytesReadCompleted();
@@ skipping 126 matching lines @@
           item.expected_modification_time());
       break;
     default:
       NOTREACHED();
   }
   DCHECK(reader);
   index_to_reader_[index] = reader;
 }
 
 }  // namespace webkit_blob