Update //base to chromium 9659b08ea5a34f889dc4166217f438095ddc10d2

base/json/json_parser.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/json/json_parser.h"
 
 #include <cmath>
 
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
@@ skipping 13 matching lines @@
 
 const int kStackMaxDepth = 100;
 
 const int32 kExtendedASCIIStart = 0x80;
 
 // This and the class below are used to own the JSON input string for when
 // string tokens are stored as StringPiece instead of std::string. This
 // optimization avoids about 2/3rds of string memory copies. The constructor
 // takes ownership of the input string. The real root value is Swap()ed into
 // the new instance.
-class DictionaryHiddenRootValue : public base::DictionaryValue {
+class DictionaryHiddenRootValue : public DictionaryValue {
  public:
   DictionaryHiddenRootValue(std::string* json, Value* root) : json_(json) {
     DCHECK(root->IsType(Value::TYPE_DICTIONARY));
     DictionaryValue::Swap(static_cast<DictionaryValue*>(root));
   }
 
   void Swap(DictionaryValue* other) override {
     DVLOG(1) << "Swap()ing a DictionaryValue inefficiently.";
 
     // First deep copy to convert JSONStringValue to std::string and swap that
     // copy with |other|, which contains the new contents of |this|.
-    scoped_ptr<base::DictionaryValue> copy(DeepCopy());
+    scoped_ptr<DictionaryValue> copy(DeepCopy());
     copy->Swap(other);
 
     // Then erase the contents of the current dictionary and swap in the
     // new contents, originally from |other|.
     Clear();
     json_.reset();
     DictionaryValue::Swap(copy.get());
   }
 
   // Not overriding DictionaryValue::Remove because it just calls through to
@@ skipping 17 matching lines @@
 
     return true;
   }
 
  private:
   scoped_ptr<std::string> json_;
 
   DISALLOW_COPY_AND_ASSIGN(DictionaryHiddenRootValue);
 };
 
-class ListHiddenRootValue : public base::ListValue {
+class ListHiddenRootValue : public ListValue {
  public:
   ListHiddenRootValue(std::string* json, Value* root) : json_(json) {
     DCHECK(root->IsType(Value::TYPE_LIST));
     ListValue::Swap(static_cast<ListValue*>(root));
   }
 
   void Swap(ListValue* other) override {
     DVLOG(1) << "Swap()ing a ListValue inefficiently.";
 
     // First deep copy to convert JSONStringValue to std::string and swap that
     // copy with |other|, which contains the new contents of |this|.
-    scoped_ptr<base::ListValue> copy(DeepCopy());
+    scoped_ptr<ListValue> copy(DeepCopy());
     copy->Swap(other);
 
     // Then erase the contents of the current list and swap in the new contents,
     // originally from |other|.
     Clear();
     json_.reset();
     ListValue::Swap(copy.get());
   }
 
   bool Remove(size_t index, scoped_ptr<Value>* out) override {
@@ skipping 16 matching lines @@
 
  private:
   scoped_ptr<std::string> json_;
 
   DISALLOW_COPY_AND_ASSIGN(ListHiddenRootValue);
 };
 
 // A variant on StringValue that uses StringPiece instead of copying the string
 // into the Value. This can only be stored in a child of hidden root (above),
 // otherwise the referenced string will not be guaranteed to outlive it.
-class JSONStringValue : public base::Value {
+class JSONStringValue : public Value {
  public:
-  explicit JSONStringValue(const base::StringPiece& piece)
-      : Value(TYPE_STRING),
-        string_piece_(piece) {
-  }
+  explicit JSONStringValue(const StringPiece& piece)
+      : Value(TYPE_STRING), string_piece_(piece) {}
 
-  // Overridden from base::Value:
+  // Overridden from Value:
   bool GetAsString(std::string* out_value) const override {
     string_piece_.CopyToString(out_value);
     return true;
   }
   bool GetAsString(string16* out_value) const override {
     *out_value = UTF8ToUTF16(string_piece_);
     return true;
   }
   Value* DeepCopy() const override {
     return new StringValue(string_piece_.as_string());
   }
   bool Equals(const Value* other) const override {
     std::string other_string;
     return other->IsType(TYPE_STRING) && other->GetAsString(&other_string) &&
         StringPiece(other_string) == string_piece_;
   }
 
  private:
   // The location in the original input stream.
-  base::StringPiece string_piece_;
+  StringPiece string_piece_;
 
   DISALLOW_COPY_AND_ASSIGN(JSONStringValue);
 };
 
 // Simple class that checks for maximum recursion/"stack overflow."
 class StackMarker {
  public:
   explicit StackMarker(int* depth) : depth_(depth) {
     ++(*depth_);
     DCHECK_LE(*depth_, kStackMaxDepth);
@@ skipping 598 matching lines @@
       return false;
 
     NextNChars(3);
 
     if (!CBU16_IS_TRAIL(code_unit16_low)) {
       return false;
     }
 
     uint32 code_point = CBU16_GET_SUPPLEMENTARY(code_unit16_high,
                                                 code_unit16_low);
+    if (!IsValidCharacter(code_point))
+      return false;
+
     offset = 0;
     CBU8_APPEND_UNSAFE(code_unit8, offset, code_point);
   } else {
     // Not a surrogate.
     DCHECK(CBU16_IS_SINGLE(code_unit16_high));
+    if (!IsValidCharacter(code_unit16_high))
+      return false;
+
     CBU8_APPEND_UNSAFE(code_unit8, offset, code_unit16_high);
   }
 
   dest_string->append(code_unit8);
   return true;
 }
 
 void JSONParser::DecodeUTF8(const int32& point, StringBuilder* dest) {
+  DCHECK(IsValidCharacter(point));
+
   // Anything outside of the basic ASCII plane will need to be decoded from
   // int32 to a multi-byte sequence.
   if (point < kExtendedASCIIStart) {
     dest->Append(static_cast<char>(point));
   } else {
     char utf8_units[4] = { 0 };
     int offset = 0;
     CBU8_APPEND_UNSAFE(utf8_units, offset, point);
     dest->Convert();
     // CBU8_APPEND_UNSAFE can overwrite up to 4 bytes, so utf8_units may not be
@@ skipping 63 matching lines @@
   pos_ = exit_pos;
   index_ = exit_index;
 
   StringPiece num_string(num_start, end_index - start_index);
 
   int num_int;
   if (StringToInt(num_string, &num_int))
     return new FundamentalValue(num_int);
 
   double num_double;
-  if (base::StringToDouble(num_string.as_string(), &num_double) &&
+  if (StringToDouble(num_string.as_string(), &num_double) &&
       std::isfinite(num_double)) {
     return new FundamentalValue(num_double);
   }
 
   return NULL;
 }
 
 bool JSONParser::ReadInt(bool allow_leading_zeros) {
   char first = *pos_;
   int len = 0;
@@ skipping 71 matching lines @@
                                            const std::string& description) {
   if (line || column) {
     return StringPrintf("Line: %i, column: %i, %s",
         line, column, description.c_str());
   }
   return description;
 }
 
 }  // namespace internal
 }  // namespace base