[mojo-edk] Better validation of untrusted message data

mojo/edk/system/channel_win.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/edk/system/channel.h"
 
 #include <stdint.h>
 #include <windows.h>
 
 #include <algorithm>
 #include <deque>
+#include <limits>
 #include <memory>
 
 #include "base/bind.h"
 #include "base/location.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/message_loop/message_loop.h"
 #include "base/synchronization/lock.h"
 #include "base/task_runner.h"
 #include "mojo/edk/embedder/platform_handle_vector.h"
@@ skipping 85 matching lines @@
         reject_writes_ = write_error = true;
     }
     if (write_error) {
       // Do not synchronously invoke OnError(). Write() may have been called by
       // the delegate and we don't want to re-enter it.
       io_task_runner_->PostTask(FROM_HERE,
                                 base::Bind(&ChannelWin::OnError, this));
     }
   }
 
-  ScopedPlatformHandleVectorPtr GetReadPlatformHandles(
+  bool GetReadPlatformHandles(
       size_t num_handles,
       const void* extra_header,
-      size_t extra_header_size) override {
+      size_t extra_header_size,
+      ScopedPlatformHandleVectorPtr* handles) override {
+    if (num_handles > std::numeric_limits<uint16_t>::max())
+      return false;
     size_t handles_size = sizeof(PlatformHandle) * num_handles;
     if (handles_size > extra_header_size)
-      return nullptr;
-
-    ScopedPlatformHandleVectorPtr handles(
-        new PlatformHandleVector(num_handles));
-    memcpy(handles->data(), extra_header, handles_size);
-    return handles;
+      return false;
+    DCHECK(extra_header);
+    handles->reset(new PlatformHandleVector(num_handles));
+    memcpy((*handles)->data(), extra_header, handles_size);
+    return true;
   }
 
  private:
   // May run on any thread.
   ~ChannelWin() override {
     // This is intentionally not 0. If another object is constructed on top of
     // this memory, it is likely to initialise values to 0. Using a non-zero
     // value lets us detect the difference between just destroying, and
     // re-allocating the memory.
     sentinel_ = UINTPTR_MAX;
@@ skipping 173 matching lines @@
 // static
 scoped_refptr<Channel> Channel::Create(
     Delegate* delegate,
     ScopedPlatformHandle platform_handle,
     scoped_refptr<base::TaskRunner> io_task_runner) {
   return new ChannelWin(delegate, std::move(platform_handle), io_task_runner);
 }
 
 }  // namespace edk
 }  // namespace mojo