Rust: Add validation to decode

mojo/public/rust/src/bindings/macros.rs

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /// This macro provides a common implementation of MojomEncodable
 /// for MojomPointer types.
 ///
 /// Note: it does not implement compute_size();
 ///
 /// The Rust type system currently lacks the facilities to do this
@@ skipping 12 matching lines @@
             $crate::bindings::mojom::POINTER_BIT_SIZE
         }
         fn encode(self, encoder: &mut $crate::bindings::encoding::Encoder, context: $crate::bindings::encoding::Context) {
             let loc = encoder.size() as u64;
             {
                 let state = encoder.get_mut(&context);
                 state.encode_pointer(loc);
             }
             self.encode_new(encoder, context);
         }
-        fn decode(decoder: &mut $crate::bindings::decoding::Decoder, context: $crate::bindings::encoding::Context) -> Self {
+        fn decode(decoder: &mut $crate::bindings::decoding::Decoder, context: $crate::bindings::encoding::Context) -> Result<Self, ValidationError> {
             let ptr = {
                 let state = decoder.get_mut(&context);
-                state.decode_pointer()
+                match state.decode_pointer() {
+                    Some(ptr) => ptr,
+                    None => return Err(ValidationError::IllegalPointer),
+                }
             };
-            Self::decode_new(decoder, context, ptr)
+            if ptr == $crate::bindings::mojom::MOJOM_NULL_POINTER {
+                Err(ValidationError::UnexpectedNullPointer)
+            } else {
+                Self::decode_new(decoder, context, ptr)
+            }
         }
     };
 }
 
 /// This macro provides a common implementation of MojomEncodable
 /// for MojomUnion types.
 ///
 /// Note: it does not implement compute_size();
 ///
 /// The Rust type system currently lacks the facilities to do this
@@ skipping 15 matching lines @@
                 Self::inline_embed_size()
             }
         }
         fn encode(self, encoder: &mut $crate::bindings::encoding::Encoder, context: $crate::bindings::encoding::Context) {
             if context.is_union() {
                 self.nested_encode(encoder, context);
             } else {
                 self.inline_encode(encoder, context.set_is_union(true));
             }
         }
-        fn decode(decoder: &mut $crate::bindings::decoding::Decoder, context: $crate::bindings::encoding::Context) -> Self {
+        fn decode(decoder: &mut $crate::bindings::decoding::Decoder, context: $crate::bindings::encoding::Context) -> Result<Self, ValidationError> {
             if context.is_union() {
                 Self::nested_decode(decoder, context)
             } else {
                 Self::inline_decode(decoder, context.set_is_union(true))
             }
         }
     }
 }
 
 /// This macro provides a common implementation of MojomEncodable
@@ skipping 19 matching lines @@
         }
         fn compute_size(&self, _context: $crate::bindings::encoding::Context) -> usize {
             0 // Indicates that this type is inlined and it adds nothing external to the size
         }
         fn encode(self, encoder: &mut $crate::bindings::encoding::Encoder, context: $crate::bindings::encoding::Context) {
             let pos = encoder.add_handle(self.as_untyped());
             let mut state = encoder.get_mut(&context);
             state.encode(pos as i32);
             state.encode(Self::version() as u32);
         }
-        fn decode(decoder: &mut $crate::bindings::decoding::Decoder, context: $crate::bindings::encoding::Context) -> Self {
-            // TODO(mknyszek): verify version
+        fn decode(decoder: &mut $crate::bindings::decoding::Decoder, context: $crate::bindings::encoding::Context) -> Result<Self, ValidationError> {
             let (handle_index, _version) = {
                 let mut state = decoder.get_mut(&context);
                 (state.decode::<i32>(), state.decode::<u32>())
             };
-            Self::new(decoder.claim_handle::<$crate::system::message_pipe::MessageEndpoint>(handle_index))
+            let handle = try!(decoder.claim_handle::<$crate::system::message_pipe::MessageEndpoint>(handle_index));
+            Ok(Self::new(handle))
         }
     }
 }
-