[mojo-edk] Add some buffer checks and fix UAF on NodeChannel

mojo/edk/system/data_pipe_producer_dispatcher.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/edk/system/data_pipe_producer_dispatcher.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <utility>
@@ skipping 491 matching lines @@
              << " [control_port=" << control_port_.name() << "]";
     peer_closed_ = true;
   } else if (rv == ports::OK && port_status.has_messages && !in_transit_) {
     ports::ScopedMessage message;
     do {
       int rv = node_controller_->node()->GetMessageIf(control_port_, nullptr,
                                                       &message);
       if (rv != ports::OK)
         peer_closed_ = true;
       if (message) {
-        PortsMessage* ports_message = static_cast<PortsMessage*>(message.get());
+        if (message->num_payload_bytes() < sizeof(DataPipeControlMessage)) {
+          peer_closed_ = true;
+          break;
+        }
+
         const DataPipeControlMessage* m =
             static_cast<const DataPipeControlMessage*>(
-                ports_message->payload_bytes());
+                message->payload_bytes());
 
         if (m->command != DataPipeCommand::DATA_WAS_READ) {
           DLOG(ERROR) << "Unexpected message from consumer.";
           peer_closed_ = true;
           break;
         }
 
         if (static_cast<size_t>(available_capacity_) + m->num_bytes >
               options_.capacity_num_bytes) {
           DLOG(ERROR) << "Consumer claims to have read too many bytes.";
@@ skipping 10 matching lines @@
   }
 
   if (peer_closed_ != was_peer_closed ||
       available_capacity_ != previous_capacity) {
     awakable_list_.AwakeForStateChange(GetHandleSignalsStateNoLock());
   }
 }
 
 }  // namespace edk
 }  // namespace mojo