[mojo-edk] Fix potential buffer overflow in BrokerHost

mojo/edk/system/broker_host_posix.cc

Index: mojo/edk/system/broker_host_posix.cc
diff --git a/mojo/edk/system/broker_host_posix.cc b/mojo/edk/system/broker_host_posix.cc
index 8734874a8ecc8c673728cec02bae2467cd907140..7a5c54e551ed571c262740e071f4ab6ae94635d5 100644
--- a/mojo/edk/system/broker_host_posix.cc
+++ b/mojo/edk/system/broker_host_posix.cc
@@ -82,19 +82,27 @@ void BrokerHost::OnBufferRequest(size_t num_bytes) {
 void BrokerHost::OnChannelMessage(const void* payload,
                                   size_t payload_size,
                                   ScopedPlatformHandleVectorPtr handles) {
+  if (payload_size < sizeof(BrokerMessageHeader))
+    return;
+
   const BrokerMessageHeader* header =
       static_cast<const BrokerMessageHeader*>(payload);
   switch (header->type) {
-    case BrokerMessageType::BUFFER_REQUEST: {
-      const BufferRequestData* request =
-          reinterpret_cast<const BufferRequestData*>(header + 1);
-      OnBufferRequest(request->size);
+    case BrokerMessageType::BUFFER_REQUEST:
+      if (payload_size ==
+            sizeof(BrokerMessageHeader) + sizeof(BufferRequestData)) {
+        const BufferRequestData* request =
+            reinterpret_cast<const BufferRequestData*>(header + 1);
+        OnBufferRequest(request->size);
+        return;
+      }
       break;
-    }
+
     default:
-      LOG(ERROR) << "Unexpected broker message type: " << header->type;
       break;
   }
+
+  LOG(ERROR) << "Unexpected broker message type: " << header->type;
 }
 
 void BrokerHost::OnChannelError() {