Protect against recursive processing of the fat header in MachOImageReader.

chrome/common/safe_browsing/mach_o_image_reader_mac.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/safe_browsing/mach_o_image_reader_mac.h"
 
 #include <libkern/OSByteOrder.h>
 #include <mach-o/fat.h>
 #include <mach-o/loader.h>
 
@@ skipping 104 matching lines @@
 
     size_t offset = sizeof(*header);
     for (uint32_t i = 0; i < nfat_arch; ++i) {
       const fat_arch* arch = data_->GetPointerAt<fat_arch>(offset);
       if (!arch)
         return false;
 
       uint32_t arch_offset = do_swap ? OSSwapInt32(arch->offset) : arch->offset;
       uint32_t arch_size = do_swap ? OSSwapInt32(arch->size) : arch->size;
 
+      // Cannot refer back to headers of previous arches to cause
+      // recursive processing.
+      if (arch_offset < offset)
+        return false;
+
       ByteSlice slice = data_->Slice(arch_offset, arch_size);
       if (!slice.IsValid())
         return false;
 
       fat_images_.push_back(new MachOImageReader());
       if (!fat_images_.back()->Initialize(slice.data(), slice.size()))
         return false;
 
       offset += sizeof(*arch);
     }
@@ skipping 106 matching lines @@
   if (lc_code_signature == nullptr)
     return false;
 
   info->resize(lc_code_signature->datasize);
   return data_->CopyDataAt(lc_code_signature->dataoff,
                            lc_code_signature->datasize,
                            &(*info)[0]);
 }
 
 }  // namespace safe_browsing