mojo/edk/system/data_pipe_producer_dispatcher.cc - Issue 2004763002: [mojo-edk] Add some buffer checks and fix UAF on NodeChannel

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Unified Diff: mojo/edk/system/data_pipe_producer_dispatcher.cc

Issue 2004763002: [mojo-edk] Add some buffer checks and fix UAF on NodeChannel (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master

Patch Set: Created 4 years, 7 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View side-by-side diff with in-line comments

Download patch

« no previous file with comments | « mojo/edk/system/data_pipe_consumer_dispatcher.cc ('k') | mojo/edk/system/message_pipe_dispatcher.cc » ('j') | mojo/edk/system/message_pipe_dispatcher.cc » ('J')
Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

Index: mojo/edk/system/data_pipe_producer_dispatcher.cc

diff --git a/mojo/edk/system/data_pipe_producer_dispatcher.cc b/mojo/edk/system/data_pipe_producer_dispatcher.cc

index 89c8d554132ba75d7ef070d2a498d04439376034..d056e7dbc8331962cc56c50b630db5125f632b7d 100644

--- a/mojo/edk/system/data_pipe_producer_dispatcher.cc

+++ b/mojo/edk/system/data_pipe_producer_dispatcher.cc

@@ -509,10 +509,14 @@ void DataPipeProducerDispatcher::UpdateSignalsStateNoLock() {

if (rv != ports::OK)

peer_closed_ = true;

if (message) {

- PortsMessage* ports_message = static_cast<PortsMessage*>(message.get());

+ if (message->num_payload_bytes() < sizeof(DataPipeControlMessage)) {

+ peer_closed_ = true;

+ break;

+ }

const DataPipeControlMessage* m =

static_cast<const DataPipeControlMessage*>(

- ports_message->payload_bytes());

+ message->payload_bytes());

if (m->command != DataPipeCommand::DATA_WAS_READ) {

DLOG(ERROR) << "Unexpected message from consumer.";