Avoid undefined behavior when checking for pointer wraparound

base/pickle.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/pickle.h"
 
 #include <stdlib.h>
 
 #include <algorithm>  // for max()
 
@@ skipping 17 matching lines @@
   if (sizeof(Type) > sizeof(uint32))
     memcpy(result, read_from, sizeof(*result));
   else
     *result = *reinterpret_cast<const Type*>(read_from);
   return true;
 }
 
 template<typename Type>
 inline const char* PickleIterator::GetReadPointerAndAdvance() {
   const char* current_read_ptr = read_ptr_;
-  if (read_ptr_ + sizeof(Type) > read_end_ptr_)
+  if (sizeof(Type) > static_cast<size_t>(read_end_ptr_ - read_ptr_))
     return NULL;
   if (sizeof(Type) < sizeof(uint32))
     read_ptr_ += AlignInt(sizeof(Type), sizeof(uint32));
   else
     read_ptr_ += sizeof(Type);
   return current_read_ptr;
 }
 
 const char* PickleIterator::GetReadPointerAndAdvance(int num_bytes) {
   if (num_bytes < 0 || read_end_ptr_ - read_ptr_ < num_bytes)
@@ skipping 235 matching lines @@
                              const char* start,
                              const char* end) {
   DCHECK_EQ(header_size, AlignInt(header_size, sizeof(uint32)));
   DCHECK_LE(header_size, static_cast<size_t>(kPayloadUnit));
 
   if (static_cast<size_t>(end - start) < sizeof(Header))
     return NULL;
 
   const Header* hdr = reinterpret_cast<const Header*>(start);
   const char* payload_base = start + header_size;
-  const char* payload_end = payload_base + hdr->payload_size;
-  if (payload_end < payload_base)
+  if (hdr->payload_size > static_cast<size_t>(end - payload_base))
     return NULL;
 
-  return (payload_end > end) ? NULL : payload_end;
+  return payload_base + hdr->payload_size;
 }
 
 template <size_t length> void Pickle::WriteBytesStatic(const void* data) {
   WriteBytesCommon(data, length);
 }
 
 template void Pickle::WriteBytesStatic<2>(const void* data);
 template void Pickle::WriteBytesStatic<4>(const void* data);
 template void Pickle::WriteBytesStatic<8>(const void* data);
 
@@ skipping 10 matching lines @@
   if (new_size > capacity_after_header_) {
     Resize(std::max(capacity_after_header_ * 2, new_size));
   }
 
   char* write = mutable_payload() + write_offset_;
   memcpy(write, data, length);
   memset(write + length, 0, data_len - length);
   header_->payload_size = static_cast<uint32>(write_offset_ + length);
   write_offset_ = new_size;
 }