Check IP address size when deserializing IPEndPoint.

content/public/common/common_param_traits.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/public/common/common_param_traits.h"
 
 #include "content/public/common/content_constants.h"
 #include "content/public/common/page_state.h"
 #include "content/public/common/referrer.h"
 #include "content/public/common/url_utils.h"
@@ skipping 102 matching lines @@
   WriteParam(m, p.address());
   WriteParam(m, p.port());
 }
 
 bool ParamTraits<net::IPEndPoint>::Read(const Message* m, PickleIterator* iter,
                                         param_type* p) {
   net::IPAddressNumber address;
   int port;
   if (!ReadParam(m, iter, &address) || !ReadParam(m, iter, &port))
     return false;
+  if (address.size() &&
+      address.size() != net::kIPv4AddressSize &&
+      address.size() != net::kIPv6AddressSize) {
+    return false;
+  }
   *p = net::IPEndPoint(address, port);
   return true;
 }
 
 void ParamTraits<net::IPEndPoint>::Log(const param_type& p, std::string* l) {
   LogParam("IPEndPoint:" + p.ToString(), l);
 }
 
 void ParamTraits<content::PageState>::Write(
     Message* m, const param_type& p) {
@@ skipping 245 matching lines @@
 #undef CONTENT_PUBLIC_COMMON_COMMON_PARAM_TRAITS_MACROS_H_
 #include "content/public/common/common_param_traits_macros.h"
 }  // namespace IPC
 
 // Generate param traits log methods.
 #include "ipc/param_traits_log_macros.h"
 namespace IPC {
 #undef CONTENT_PUBLIC_COMMON_COMMON_PARAM_TRAITS_MACROS_H_
 #include "content/public/common/common_param_traits_macros.h"
 }  // namespace IPC