[mojo-edk] Fix potential buffer overflow in BrokerHost

mojo/edk/system/broker_host_posix.cc

Index: mojo/edk/system/broker_host_posix.cc
diff --git a/mojo/edk/system/broker_host_posix.cc b/mojo/edk/system/broker_host_posix.cc
index 431b30d80194f7a7f46552eb0df1e7d13aa7fd85..9c4eeae1c34f03fd4fc5540914c9a63d5b9367fc 100644
--- a/mojo/edk/system/broker_host_posix.cc
+++ b/mojo/edk/system/broker_host_posix.cc
@@ -88,19 +88,27 @@ void BrokerHost::OnBufferRequest(size_t num_bytes) {
 void BrokerHost::OnChannelMessage(const void* payload,
                                   size_t payload_size,
                                   ScopedPlatformHandleVectorPtr handles) {
+  if (payload_size < sizeof(BrokerMessageHeader))
+    return;
+
   const BrokerMessageHeader* header =
       static_cast<const BrokerMessageHeader*>(payload);
   switch (header->type) {
-    case BrokerMessageType::BUFFER_REQUEST: {
-      const BufferRequestData* request =
-          reinterpret_cast<const BufferRequestData*>(header + 1);
-      OnBufferRequest(request->size);
+    case BrokerMessageType::BUFFER_REQUEST:
+      if (payload_size ==
+            sizeof(BrokerMessageHeader) + sizeof(BufferRequestData)) {
+        const BufferRequestData* request =
+            reinterpret_cast<const BufferRequestData*>(header + 1);
+        OnBufferRequest(request->size);
+        return;
+      }
       break;
-    }
+
     default:
-      LOG(ERROR) << "Unexpected broker message type: " << header->type;
       break;
   }
+
+  LOG(ERROR) << "Unexpected broker message type: " << header->type;
 }
 
 void BrokerHost::OnChannelError() {