Rust: Add validation to decode

mojo/public/rust/src/bindings/encoding.rs

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 use bindings::mojom::MOJOM_NULL_POINTER;
 use bindings::util;
 
 use std::mem;
 use std::ptr;
 use std::ops::{Add, AddAssign, Sub, Mul, Div, Rem};
@@ skipping 23 matching lines @@
     }
 
     /// Return 1 left-shifted by the amount of bits stored here.
     ///
     /// Only guaranteed to work for up to 8 bits.
     pub fn as_set_bit(self) -> u8 {
         debug_assert!(self.0 < 8);
         1 << (self.0 & 7)
     }
 
+    pub fn checked_mul(self, val: usize) -> Option<Bits> {
+        match val.checked_mul(self.0) {
+            Some(result) => Some(Bits(result)),
+            None => None,
+        }
+    }
+
     /// Align the bits to some number of bytes.
     pub fn align_to_bytes(&mut self, bytes: usize) {
         self.0 = util::align_bytes(self.0, 8 * bytes);
     }
 }
 
 impl Add for Bits {
     type Output = Self;
     fn add(self, rhs: Self) -> Self {
         Bits(self.0 + rhs.0)
@@ skipping 11 matching lines @@
     fn mul(self, rhs: usize) -> Self {
         Bits(self.0 * rhs)
     }
 }
 
 /// This trait is intended to be used by Mojom primitive values
 /// in order to be identified in generic contexts.
 pub trait MojomNumeric: Copy + Clone + Sized + Add<Self> + Sub<Self, Output=Self> + Mul<Self> +
     Div<Self, Output=Self> + Rem<Self, Output=Self> + PartialEq<Self> + Default {
 
-    /// Converts the primitive to a little-endian representation (the mojom endianness).
+/// Converts the primitive to a little-endian representation (the mojom endianness).
     fn to_mojom_endian(self) -> Self;
 }
 
 macro_rules! impl_mojom_numeric_for_prim {
     ($($t:ty),*) => {
         $(
         impl MojomNumeric for $t {
             fn to_mojom_endian(self) -> $t { self.to_le() }
         }
         )*
@@ skipping 128 matching lines @@
 
     /// The current bit offset within 'data'.
     bit_offset: Bits,
 }
 
 impl<'slice> EncodingState<'slice> {
     /// Create a new encoding state.
     ///
     /// Note: the encoder will not allocate a buffer for you, rather
     /// a pre-allocated buffer must be passed in.
-    pub fn new(buffer: &'slice mut [u8], header: &DataHeader, offset: usize) -> EncodingState<'slice> {
+    pub fn new(buffer: &'slice mut [u8],
+               header: &DataHeader,
+               offset: usize)
+               -> EncodingState<'slice> {
         let mut state = EncodingState {
             data: buffer,
             global_offset: offset,
             offset: 0,
             bit_offset: Bits(0),
         };
         state.write(header.size());
         state.write(header.data());
         state
     }
@@ skipping 148 matching lines @@
     }
 
     /// Signal to finish encoding by destroying the Encoder and returning the final
     /// handle vector.
     ///
     /// Note: No byte buffer is returned as that is pre-allocated.
     pub fn unwrap(self) -> Vec<UntypedHandle> {
         self.handles
     }
 }