[mojo-edk] Fix potential buffer overflow in BrokerHost

mojo/edk/system/broker_host_posix.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/edk/system/broker_host.h"
 
 #include <fcntl.h>
 #include <unistd.h>
 
 #include <utility>
@@ skipping 70 matching lines @@
     handles->at(1) = read_only_buffer->PassPlatformHandle().release();
     message->SetHandles(std::move(handles));
   }
 
   channel_->Write(std::move(message));
 }
 
 void BrokerHost::OnChannelMessage(const void* payload,
                                   size_t payload_size,
                                   ScopedPlatformHandleVectorPtr handles) {
+  if (payload_size < sizeof(BrokerMessageHeader))
+    return;
+
   const BrokerMessageHeader* header =
       static_cast<const BrokerMessageHeader*>(payload);
   switch (header->type) {
-    case BrokerMessageType::BUFFER_REQUEST: {
-      const BufferRequestData* request =
-          reinterpret_cast<const BufferRequestData*>(header + 1);
-      OnBufferRequest(request->size);
+    case BrokerMessageType::BUFFER_REQUEST:
+      if (payload_size ==
+            sizeof(BrokerMessageHeader) + sizeof(BufferRequestData)) {
+        const BufferRequestData* request =
+            reinterpret_cast<const BufferRequestData*>(header + 1);
+        OnBufferRequest(request->size);
+        return;
+      }
       break;
-    }
+
     default:
-      LOG(ERROR) << "Unexpected broker message type: " << header->type;
       break;
   }
+
+  LOG(ERROR) << "Unexpected broker message type: " << header->type;
 }
 
 void BrokerHost::OnChannelError() {
   if (channel_) {
     channel_->ShutDown();
     channel_ = nullptr;
   }
 
   delete this;
 }
 
 void BrokerHost::WillDestroyCurrentMessageLoop() {
   delete this;
 }
 
 }  // namespace edk
 }  // namespace mojo