Check the size of of the dyld_all_image_infos structure before using it

snapshot/mac/process_reader.cc

 // Copyright 2014 The Crashpad Authors. All rights reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //     http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ skipping 356 matching lines @@
     }
   }
 #endif
 
   process_types::dyld_all_image_infos all_image_infos;
   if (!all_image_infos.Read(this, dyld_info.all_image_info_addr)) {
     LOG(WARNING) << "could not read dyld_all_image_infos";
     return;
   }
 
-  DCHECK_GE(all_image_infos.version, 1u);
+  if (all_image_infos.version < 1) {
+    LOG(WARNING) << "unexpected dyld_all_image_infos version "
+                 << all_image_infos.version;
+    return;
+  }
+
+  size_t expected_size =
+      process_types::dyld_all_image_infos::ExpectedSizeForVersion(
+          this, all_image_infos.version);
+  if (dyld_info.all_image_info_size < expected_size) {
+    LOG(WARNING) << "small dyld_all_image_infos size "
+                 << dyld_info.all_image_info_size << " < " << expected_size
+                 << " for version " << all_image_infos.version;
+    return;
+  }
 
   // Note that all_image_infos.infoArrayCount may be 0 if a crash occurred while
   // dyld was loading the executable. This can happen if a required dynamic
   // library was not found. Similarly, all_image_infos.infoArray may be nullptr
   // if a crash occurred while dyld was updating it.
   //
   // TODO(mark): It may be possible to recover from these situations by looking
   // through memory mappings for Mach-O images.
   //
   // Continue along when this situation is detected, because even without any
@@ skipping 303 matching lines @@
       // The red zone would go lower into another region in memory, but no
       // region was found. Memory can only be captured to an address as low as
       // the base address of the region already found.
       *start_address = *region_base;
     }
   }
 #endif
 }
 
 }  // namespace crashpad