Rust: Add validation to decode

mojo/public/rust/src/bindings/mojom.rs

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+use bindings::decoding::{Decoder, ValidationError};
 use bindings::encoding;
 use bindings::encoding::{Bits, Encoder, Context, DATA_HEADER_SIZE, DataHeader, DataHeaderValue};
-use bindings::decoding::Decoder;
-
 use bindings::message::MessageHeader;
 
 use std::cmp::Eq;
 use std::collections::HashMap;
 use std::hash::Hash;
 use std::mem;
 use std::ptr;
 use std::vec::Vec;
 
 use system::{CastHandle, Handle, UntypedHandle};
 use system::data_pipe;
 use system::message_pipe;
 use system::shared_buffer;
 use system::wait_set;
 
 /// The size of a Mojom map plus header in bytes.
 const MAP_SIZE: usize = 24;
 
+/// The sorted set of versions for a map.
+const MAP_VERSIONS: [(u32, u32); 1] = [(0, MAP_SIZE as u32)];
+
 /// The size of a Mojom union in bytes (header included).
 pub const UNION_SIZE: usize = 16;
 
 /// The size of a Mojom pointer in bits.
 pub const POINTER_BIT_SIZE: Bits = Bits(64);
 
 /// The value of a Mojom null pointer.
 pub const MOJOM_NULL_POINTER: u64 = 0;
 
 /// An enumeration of all the possible low-level Mojom types.
@@ skipping 18 matching lines @@
     fn embed_size(context: &Context) -> Bits;
 
     /// Recursively computes the size of the complete Mojom archive
     /// starting from this type.
     fn compute_size(&self, context: Context) -> usize;
 
     /// Encodes this type into the encoder given a context.
     fn encode(self, encoder: &mut Encoder, context: Context);
 
     /// Using a decoder, decodes itself out of a byte buffer.
-    fn decode(decoder: &mut Decoder, context: Context) -> Self;
+    fn decode(decoder: &mut Decoder, context: Context) -> Result<Self, ValidationError>;
 }
 
 /// Whatever implements this trait is a Mojom pointer type which means
 /// that on encode, a pointer is inlined and the implementer is
 /// serialized elsewhere in the output buffer.
 pub trait MojomPointer: MojomEncodable {
     /// Get the DataHeader meta-data for this pointer type.
     fn header_data(&self) -> DataHeaderValue;
 
     /// Get the size of only this type when serialized.
     fn serialized_size(&self, context: &Context) -> usize;
 
     /// Encodes the actual values of the type into the encoder.
     fn encode_value(self, encoder: &mut Encoder, context: Context);
 
     /// Decodes the actual values of the type into the decoder.
-    fn decode_value(decoder: &mut Decoder, context: Context) -> Self;
+    fn decode_value(decoder: &mut Decoder, context: Context) -> Result<Self, ValidationError>;
 
     /// Writes a pointer inlined into the current context before calling
     /// encode_value.
     fn encode_new(self, encoder: &mut Encoder, context: Context) {
         let data_size = self.serialized_size(&context);
         let data_header = DataHeader::new(data_size, self.header_data());
         let new_context = encoder.add(&data_header).unwrap();
         self.encode_value(encoder, new_context);
     }
 
     /// Reads a pointer inlined into the current context before calling
     /// decode_value.
-    fn decode_new(decoder: &mut Decoder, _context: Context, pointer: u64) -> Self {
-        let new_context = decoder.claim(pointer as usize).unwrap();
+    fn decode_new(decoder: &mut Decoder,
+                  _context: Context,
+                  pointer: u64)
+                  -> Result<Self, ValidationError> {
+        let new_context = try!(decoder.claim(pointer as usize));
         Self::decode_value(decoder, new_context)
     }
 }
 
 /// Whatever implements this trait is a Mojom union type which means that
 /// on encode it is inlined, but if the union is nested inside of another
 /// union type, it is treated as a pointer type.
 pub trait MojomUnion: MojomEncodable {
     /// Get the union's current tag.
     fn get_tag(&self) -> u32;
 
     /// Encode the actual value of the union.
     fn encode_value(self, encoder: &mut Encoder, context: Context);
 
     /// Decode the actual value of the union.
-    fn decode_value(decoder: &mut Decoder, context: Context) -> Self;
+    fn decode_value(decoder: &mut Decoder, context: Context) -> Result<Self, ValidationError>;
 
     /// The embed_size for when the union acts as a pointer type.
     fn nested_embed_size() -> Bits {
         POINTER_BIT_SIZE
     }
 
     /// The encoding routine for when the union acts as a pointer type.
     fn nested_encode(self, encoder: &mut Encoder, context: Context) {
         let loc = encoder.size() as u64;
         {
             let state = encoder.get_mut(&context);
             state.encode_pointer(loc);
         }
         let tag = DataHeaderValue::UnionTag(self.get_tag());
         let data_header = DataHeader::new(UNION_SIZE, tag);
         let new_context = encoder.add(&data_header).unwrap();
         self.encode_value(encoder, new_context.set_is_union(true));
     }
 
     /// The decoding routine for when the union acts as a pointer type.
-    fn nested_decode(decoder: &mut Decoder, context: Context) -> Self {
+    fn nested_decode(decoder: &mut Decoder, context: Context) -> Result<Self, ValidationError> {
         let global_offset = {
             let state = decoder.get_mut(&context);
-            state.decode_pointer() as usize
+            match state.decode_pointer() {
+                Some(ptr) => ptr as usize,
+                None => return Err(ValidationError::IllegalPointer),
+            }
         };
-        let new_context = decoder.claim(global_offset).unwrap();
+        if global_offset == (MOJOM_NULL_POINTER as usize) {
+            return Err(ValidationError::UnexpectedNullPointer);
+        }
+        let new_context = try!(decoder.claim(global_offset as usize));
         Self::decode_value(decoder, new_context)
     }
 
     /// The embed_size for when the union is inlined into the current context.
     fn inline_embed_size() -> Bits {
         Bits(8 * (UNION_SIZE as usize))
     }
 
     /// The encoding routine for when the union is inlined into the current context.
     fn inline_encode(self, encoder: &mut Encoder, context: Context) {
         {
             let mut state = encoder.get_mut(&context);
             state.align_to_bytes(8);
             state.encode(UNION_SIZE as u32);
             state.encode(self.get_tag());
         }
         self.encode_value(encoder, context.clone());
         {
             let mut state = encoder.get_mut(&context);
             state.align_to_bytes(8);
             state.align_to_byte();
         }
     }
 
     /// The decoding routine for when the union is inlined into the current context.
-    fn inline_decode(decoder: &mut Decoder, context: Context) -> Self {
+    fn inline_decode(decoder: &mut Decoder, context: Context) -> Result<Self, ValidationError> {
         {
             let mut state = decoder.get_mut(&context);
             state.align_to_byte();
             state.align_to_bytes(8);
         }
-        let value = Self::decode_value(decoder, context.clone());
+        let value = try!(Self::decode_value(decoder, context.clone()));
         {
             let mut state = decoder.get_mut(&context);
             state.align_to_byte();
             state.align_to_bytes(8);
         }
-        value
+        Ok(value)
     }
 }
 
 /// A marker trait that marks Mojo handles as encodable.
 pub trait MojomHandle: CastHandle + MojomEncodable {}
 
 /// Whatever implements this trait is considered to be a Mojom
 /// interface, that is, a message pipe which conforms to some
 /// messaging interface.
 ///
@@ skipping 49 matching lines @@
 /// interface that may recieve messages for some interface.
 ///
 /// When implementing this trait, specify the container "union" type
 /// which can contain any of the potential messages that may be recieved.
 /// This way, we can return that type and let the user multiplex over
 /// what message was received.
 pub trait MojomInterfaceRecv: MojomInterface {
     type Container: MojomMessageOption;
 
     /// Tries to read a message from a pipe and decodes it.
-    fn recv_response(&self) -> Self::Container {
+    fn recv_response(&self) -> Result<Self::Container, ValidationError> {
         // TODO(mknyszek): Actually handle errors with reading
         let (buffer, handles) = self.pipe().read(mpflags!(Read::None)).unwrap();
         Self::Container::decode_message(buffer, handles)
     }
 }
 
 /// Whatever implements this trait is considered to be a Mojom struct.
 ///
 /// Mojom structs are always the root of any Mojom message. Thus, we
 /// provide convenience functions for serialization here.
 pub trait MojomStruct: MojomPointer {
     /// Given a pre-allocated buffer, the struct serializes itself.
     fn serialize(self, buffer: &mut [u8]) -> Vec<UntypedHandle> {
         let mut encoder = Encoder::new(buffer);
         self.encode_new(&mut encoder, Default::default());
         encoder.unwrap()
     }
 
     /// The struct computes its own size, allocates a buffer, and then
     /// serializes itself into that buffer.
     fn auto_serialize(self) -> (Vec<u8>, Vec<UntypedHandle>) {
         let size = self.compute_size(Default::default());
         let mut buf = Vec::with_capacity(size);
         buf.resize(size, 0);
         let handles = self.serialize(&mut buf);
         (buf, handles)
     }
 
     /// Decode the type from a byte array and a set of handles.
-    fn deserialize(buffer: &mut [u8], handles: Vec<UntypedHandle>) -> Self {
+    fn deserialize(buffer: &mut [u8],
+                   handles: Vec<UntypedHandle>)
+                   -> Result<Self, ValidationError> {
         let mut decoder = Decoder::new(buffer, handles);
         Self::decode_new(&mut decoder, Default::default(), 0)
     }
 }
 
 /// Marks a MojomStruct as being capable of being sent across some
 /// Mojom interface.
 pub trait MojomMessage: MojomStruct {
     fn create_header() -> MessageHeader;
 }
 
 /// The trait for a "container" type intended to be used in MojomInterfaceRecv.
 ///
 /// This trait contains the decode logic which decodes based on the message header
 /// and returns itself: a union type which may contain any of the possible messages
 /// that may be sent across this interface.
 pub trait MojomMessageOption: Sized {
     /// Decodes the actual payload of the message.
     ///
     /// Implemented by a code generator.
-    fn decode_payload(name: u32, buffer: &mut [u8], handles: Vec<UntypedHandle>) -> Self;
+    fn decode_payload(header: MessageHeader,
+                      buffer: &mut [u8],
+                      handles: Vec<UntypedHandle>)
+                      -> Result<Self, ValidationError>;
 
     /// Decodes the message header and then the payload, returning a new
     /// copy of itself.
-    fn decode_message(mut buffer: Vec<u8>, handles: Vec<UntypedHandle>) -> Self {
-        let header = MessageHeader::deserialize(&mut buffer[..], Vec::new());
+    fn decode_message(mut buffer: Vec<u8>,
+                      handles: Vec<UntypedHandle>)
+                      -> Result<Self, ValidationError> {
+        let header = try!(MessageHeader::deserialize(&mut buffer[..], Vec::new()));
         let payload_buffer = &mut buffer[header.serialized_size(&Default::default())..];
-        Self::decode_payload(header.name, payload_buffer, handles)
+        Self::decode_payload(header, payload_buffer, handles)
     }
 }
 
 // ********************************************** //
 // ****** IMPLEMENTATIONS FOR COMMON TYPES ****** //
 // ********************************************** //
 
 macro_rules! impl_encodable_for_prim {
     ($($prim_type:ty),*) => {
         $(
         impl MojomEncodable for $prim_type {
             fn mojom_type() -> MojomType {
                 MojomType::Simple
             }
             fn mojom_alignment() -> usize {
                 mem::size_of::<$prim_type>()
             }
             fn embed_size(_context: &Context) -> Bits {
                 Bits(8 * mem::size_of::<$prim_type>())
             }
             fn compute_size(&self, _context: Context) -> usize {
                 0 // Indicates that this type is inlined and it adds nothing external to the size
             }
             fn encode(self, encoder: &mut Encoder, context: Context) {
                 let mut state = encoder.get_mut(&context);
                 state.encode(self);
             }
-            fn decode(decoder: &mut Decoder, context: Context) -> Self {
+            fn decode(decoder: &mut Decoder, context: Context) -> Result<Self, ValidationError> {
                 let mut state = decoder.get_mut(&context);
-                state.decode::<Self>()
+                Ok(state.decode::<Self>())
             }
         }
         )*
     }
 }
 
 impl_encodable_for_prim!(i8, i16, i32, i64, u8, u16, u32, u64, f32, f64);
 
 impl MojomEncodable for bool {
     fn mojom_alignment() -> usize {
-        panic!("Should never check mojom_alignment of bools (they're bit-aligned)!");
+        panic!("Should never check_decode mojom_alignment of bools (they're bit-aligned)!");
     }
     fn mojom_type() -> MojomType {
         MojomType::Simple
     }
     fn embed_size(_context: &Context) -> Bits {
         Bits(1)
     }
     fn compute_size(&self, _context: Context) -> usize {
         0 // Indicates that this type is inlined and it adds nothing external to the size
     }
     fn encode(self, encoder: &mut Encoder, context: Context) {
         let mut state = encoder.get_mut(&context);
         state.encode_bool(self);
     }
-    fn decode(decoder: &mut Decoder, context: Context) -> Self {
+    fn decode(decoder: &mut Decoder, context: Context) -> Result<Self, ValidationError> {
         let mut state = decoder.get_mut(&context);
-        state.decode_bool()
+        Ok(state.decode_bool())
     }
 }
 
 // Options should be considered to represent nullability the Mojom IDL.
 // Any type wrapped in an Option type is nullable.
 
 impl<T: MojomEncodable> MojomEncodable for Option<T> {
     fn mojom_alignment() -> usize {
         T::mojom_alignment()
     }
@@ skipping 14 matching lines @@
             Some(value) => value.encode(encoder, context),
             None => {
                 let mut state = encoder.get_mut(&context);
                 match T::mojom_type() {
                     MojomType::Pointer => state.encode_null_pointer(),
                     MojomType::Union => state.encode_null_union(),
                     MojomType::Handle => state.encode_null_handle(),
                     MojomType::Interface => {
                         state.encode_null_handle();
                         state.encode(0 as u32);
-                    },
+                    }
                     MojomType::Simple => panic!("Unexpected simple type in Option!"),
                 }
-            },
+            }
         }
     }
-    fn decode(decoder: &mut Decoder, context: Context) -> Self {
+    fn decode(decoder: &mut Decoder, context: Context) -> Result<Self, ValidationError> {
         let skipped = {
             let mut state = decoder.get_mut(&context);
             match T::mojom_type() {
                 MojomType::Pointer => state.skip_if_null_pointer(),
                 MojomType::Union => state.skip_if_null_union(),
                 MojomType::Handle => state.skip_if_null_handle(),
                 MojomType::Interface => state.skip_if_null_interface(),
                 MojomType::Simple => panic!("Unexpected simple type in Option!"),
             }
         };
         if skipped {
-            None
+            Ok(None)
         } else {
-            Some(T::decode(decoder, context))
+            let inner_value = try!(T::decode(decoder, context));
+            Ok(Some(inner_value))
         }
     }
 }
 
 macro_rules! impl_pointer_for_array {
     () => {
         fn header_data(&self) -> DataHeaderValue {
             DataHeaderValue::Elements(self.len() as u32)
         }
         fn serialized_size(&self, context: &Context) -> usize {
@@ skipping 19 matching lines @@
     }
 }
 
 impl<T: MojomEncodable> MojomPointer for Vec<T> {
     impl_pointer_for_array!();
     fn encode_value(self, encoder: &mut Encoder, context: Context) {
         for elem in self.into_iter() {
             elem.encode(encoder, context.clone());
         }
     }
-    fn decode_value(decoder: &mut Decoder, context: Context) -> Vec<T> {
-        // TODO(mknyszek): Verify elems, bytes, and T::embed_size match
-        let (_bytes, elems) = {
+    fn decode_value(decoder: &mut Decoder, context: Context) -> Result<Vec<T>, ValidationError> {
+        let elems = {
             let mut state = decoder.get_mut(&context);
-            (state.decode::<u32>(), state.decode::<u32>())
+            try!(state.decode_array_header::<T>()).data()
         };
         let mut value = Vec::with_capacity(elems as usize);
-        // TODO(mknyszek): Don't trust elems blindly
         for _ in 0..elems {
-            value.push(T::decode(decoder, context.clone()));
+            let elem = try!(T::decode(decoder, context.clone()));
+            value.push(elem);
         }
-        value
+        Ok(value)
     }
 }
 
 impl<T: MojomEncodable> MojomEncodable for Vec<T> {
     impl_encodable_for_array!();
 }
 
 macro_rules! impl_encodable_for_boxed_fixed_array {
     ($($len:expr),*) => {
         $(
         impl<T: MojomEncodable> MojomPointer for Box<[T; $len]> {
             impl_pointer_for_array!();
             fn encode_value(self, encoder: &mut Encoder, context: Context) {
                 for elem in (self as Box<[T]>).into_vec().into_iter() {
                     elem.encode(encoder, context.clone());
                 }
             }
-            fn decode_value(decoder: &mut Decoder, context: Context) -> Box<[T; $len]> {
-                // TODO(mknyszek): Verify elems, bytes, and T::embed_size match
-                let (_bytes, elems) = {
+            fn decode_value(decoder: &mut Decoder, context: Context) -> Result<Box<[T; $len]>, ValidationError> {
+                let elems = {
                     let mut state = decoder.get_mut(&context);
-                    (state.decode::<u32>(), state.decode::<u32>())
+                    try!(state.decode_array_header::<T>()).data()
                 };
-                assert_eq!(elems, $len);
+                if elems != $len {
+                    return Err(ValidationError::UnexpectedArrayHeader);
+                }
                 let mut array: [T; $len];
+                let mut error = None;
                 unsafe {
                     // Since we don't force Default to be implemented on Mojom types
                     // (mainly due to handles) we need to create this array as uninitialized
                     // and initialize it manually.
                     array = mem::uninitialized();
+                    let mut inits = 0;
                     for elem in &mut array[..] {
-                        ptr::write(elem, T::decode(decoder, context.clone()));
+                        match T::decode(decoder, context.clone()) {
+                            Ok(value) => ptr::write(elem, value),
+                            Err(err) => {
+                                error = Some(err);
+                                break;
+                            },
+                        }
+                        inits += 1;
+                    }
+                    // An error occurred, so we need to do some clean-up.
+                    if inits != $len {
+                        for i in 0..inits {
+                            ptr::drop_in_place(&mut array[i] as *mut T);
+                        }
+                        mem::forget(array);
+                        return Err(error.take().expect("Corrupted stack?"));
                     }
                 }
-                Box::new(array)
+                Ok(Box::new(array))
             }
         }
         impl<T: MojomEncodable> MojomEncodable for Box<[T; $len]> {
             impl_encodable_for_array!();
         }
         )*
     }
 }
 
 // Unfortunately, we cannot be generic over the length of a fixed array
 // even though its part of the type (this will hopefully be added in the
 // future) so for now we implement encodable for only the first 33 fixed
 // size array types.
 impl_encodable_for_boxed_fixed_array!( 0,  1,  2,  3,  4,  5,  6,  7,
                                        8,  9, 10, 11, 12, 13, 14, 15,
                                       16, 17, 18, 19, 20, 21, 22, 23,
                                       24, 25, 26, 27, 28, 29, 30, 31,
                                       32);
 
 impl<T: MojomEncodable> MojomPointer for Box<[T]> {
     impl_pointer_for_array!();
     fn encode_value(self, encoder: &mut Encoder, context: Context) {
         for elem in self.into_vec().into_iter() {
             elem.encode(encoder, context.clone());
         }
     }
-    fn decode_value(decoder: &mut Decoder, context: Context) -> Box<[T]> {
-        Vec::<T>::decode_value(decoder, context).into_boxed_slice()
+    fn decode_value(decoder: &mut Decoder, context: Context) -> Result<Box<[T]>, ValidationError> {
+        let vec_value = try!(Vec::<T>::decode_value(decoder, context));
+        Ok(vec_value.into_boxed_slice())
     }
 }
 
 impl<T: MojomEncodable> MojomEncodable for Box<[T]> {
     impl_encodable_for_array!();
 }
 
 // We can represent a Mojom string as just a Rust String type
 // since both are UTF-8.
 impl MojomPointer for String {
     fn header_data(&self) -> DataHeaderValue {
         DataHeaderValue::Elements(self.len() as u32)
     }
     fn serialized_size(&self, _context: &Context) -> usize {
         DATA_HEADER_SIZE + self.len()
     }
     fn encode_value(self, encoder: &mut Encoder, context: Context) {
         for byte in self.as_bytes() {
             byte.encode(encoder, context.clone());
         }
     }
-    fn decode_value(decoder: &mut Decoder, context: Context) -> String {
+    fn decode_value(decoder: &mut Decoder, context: Context) -> Result<String, ValidationError> {
         let mut state = decoder.get_mut(&context);
-        // TODO(mknyszek): Verify elems, bytes, and T::embed_size match
-        let _bytes = state.decode::<u32>();
-        let elems = state.decode::<u32>();
+        let elems = try!(state.decode_array_header::<u8>()).data();
         let mut value = Vec::with_capacity(elems as usize);
-        // TODO(mknyszek): Don't trust elems blindly
         for _ in 0..elems {
             value.push(state.decode::<u8>());
         }
         match String::from_utf8(value) {
-            Ok(string) => string,
-            // TODO(mknyszek): Don't panic and return an error
+            Ok(string) => Ok(string),
             Err(err) => panic!("Error decoding String: {}", err),
         }
     }
 }
 
 impl MojomEncodable for String {
     impl_encodable_for_pointer!();
     fn compute_size(&self, context: Context) -> usize {
         encoding::align_default(self.serialized_size(&context))
     }
 }
 
+/// Helper function to clean up duplicate code in HashMap.
+fn array_claim_and_decode_header<T: MojomEncodable>
+    (decoder: &mut Decoder,
+     offset: usize)
+     -> Result<(Context, usize), ValidationError> {
+    let context = try!(decoder.claim(offset));
+    let elems = {
+        let state = decoder.get_mut(&context);
+        try!(state.decode_array_header::<T>()).data()
+    };
+    Ok((context, elems as usize))
+}
+
 impl<K: MojomEncodable + Eq + Hash, V: MojomEncodable> MojomPointer for HashMap<K, V> {
     fn header_data(&self) -> DataHeaderValue {
         DataHeaderValue::Version(0)
     }
     fn serialized_size(&self, _context: &Context) -> usize {
         MAP_SIZE
     }
     fn encode_value(self, encoder: &mut Encoder, context: Context) {
         let elems = self.len();
         let meta_value = DataHeaderValue::Elements(elems as u32);
@@ skipping 13 matching lines @@
         // Claim space for the keys array in the encoder
         let keys_context = encoder.add(&keys_data_header).unwrap();
         // Encode keys, setup vals
         for (key, value) in self.into_iter() {
             key.encode(encoder, keys_context.clone());
             vals_vec.push(value);
         }
         // Encode vals
         vals_vec.encode(encoder, context.clone())
     }
-    fn decode_value(decoder: &mut Decoder, context: Context) -> HashMap<K, V> {
-        // TODO(mknyszek): Verify elems, bytes, and T::embed_size match
+    fn decode_value(decoder: &mut Decoder,
+                    context: Context)
+                    -> Result<HashMap<K, V>, ValidationError> {
         let (keys_offset, vals_offset) = {
-            let mut state = decoder.get_mut(&context);
-            let _bytes = state.decode::<u32>();
-            let _version = state.decode::<u32>();
-            let keys_offset = state.decode_pointer() as usize;
-            let vals_offset = state.decode_pointer() as usize;
-            (keys_offset, vals_offset)
+            let state = decoder.get_mut(&context);
+            try!(state.decode_struct_header(&MAP_VERSIONS));
+            // Decode the keys pointer and check for overflow
+            let keys_offset = match state.decode_pointer() {
+                Some(ptr) => ptr,
+                None => return Err(ValidationError::IllegalPointer),
+            };
+            // Decode the keys pointer and check for overflow
+            let vals_offset = match state.decode_pointer() {
+                Some(ptr) => ptr,
+                None => return Err(ValidationError::IllegalPointer),
+            };
+            if keys_offset == MOJOM_NULL_POINTER || vals_offset == MOJOM_NULL_POINTER {
+                return Err(ValidationError::UnexpectedNullPointer);
+            }
+            (keys_offset as usize, vals_offset as usize)
         };
-        let keys_context = decoder.claim(keys_offset).unwrap();
-        let keys_elems = {
-            let state = decoder.get_mut(&keys_context);
-            let _size_keys = state.decode::<u32>();
-            state.decode::<u32>()
-        };
+        let (keys_context, keys_elems) =
+            try!(array_claim_and_decode_header::<K>(decoder, keys_offset));
         let mut keys_vec: Vec<K> = Vec::with_capacity(keys_elems as usize);
         for _ in 0..keys_elems {
-            let key = K::decode(decoder, keys_context.clone());
+            let key = try!(K::decode(decoder, keys_context.clone()));
             keys_vec.push(key);
         }
-        let vals_context = decoder.claim(vals_offset).unwrap();
-        let vals_elems = {
-            let state = decoder.get_mut(&vals_context);
-            let _size_vals = state.decode::<u32>();
-            state.decode::<u32>()
-        };
-        // TODO(mknyszek): Do a validation error instead
-        assert_eq!(keys_elems, vals_elems);
-        // TODO(mknyszek): Don't trust elems blindly
+        let (vals_context, vals_elems) =
+            try!(array_claim_and_decode_header::<V>(decoder, vals_offset));
+        if keys_elems != vals_elems {
+            return Err(ValidationError::DifferentSizedArraysInMap);
+        }
         let mut map = HashMap::with_capacity(keys_elems as usize);
         for key in keys_vec.into_iter() {
-            let val = V::decode(decoder, vals_context.clone());
+            let val = try!(V::decode(decoder, vals_context.clone()));
             map.insert(key, val);
         }
-        map
+        Ok(map)
     }
 }
 
 impl<K: MojomEncodable + Eq + Hash, V: MojomEncodable> MojomEncodable for HashMap<K, V> {
     impl_encodable_for_pointer!();
     fn compute_size(&self, context: Context) -> usize {
         let mut size = encoding::align_default(self.serialized_size(&context));
         // The size of the one array
         size += DATA_HEADER_SIZE;
         size += (K::embed_size(&context) * self.len()).as_bytes();
@@ skipping 13 matching lines @@
             size += value.compute_size(context.clone());
         }
         // Align one more time at the end to keep the next object aligned.
         encoding::align_default(size)
     }
 }
 
 impl<T: MojomEncodable + CastHandle + Handle> MojomHandle for T {}
 
 macro_rules! impl_encodable_for_handle {
-    ($handle_type:path) => {
+    ($handle_t:path) => {
         fn mojom_alignment() -> usize {
             4
         }
         fn mojom_type() -> MojomType {
             MojomType::Handle
         }
         fn embed_size(_context: &Context) -> Bits {
             Bits(8 * mem::size_of::<u32>())
         }
         fn compute_size(&self, _context: Context) -> usize {
             0
         }
         fn encode(self, encoder: &mut Encoder, context: Context) {
             let pos = encoder.add_handle(self.as_untyped());
             let mut state = encoder.get_mut(&context);
             state.encode(pos as i32);
         }
-        fn decode(decoder: &mut Decoder, context: Context) -> $handle_type {
-            // TODO(mknyszek): Verify handle index
+        fn decode(decoder: &mut Decoder, context: Context) -> Result<$handle_t, ValidationError> {
             let handle_index = {
                 let mut state = decoder.get_mut(&context);
                 state.decode::<i32>()
             };
-            decoder.claim_handle::<$handle_type>(handle_index)
+            decoder.claim_handle::<$handle_t>(handle_index)
         }
     }
 }
 
 impl MojomEncodable for UntypedHandle {
     impl_encodable_for_handle!(UntypedHandle);
 }
 
 impl MojomEncodable for message_pipe::MessageEndpoint {
     impl_encodable_for_handle!(message_pipe::MessageEndpoint);
 }
 
 impl MojomEncodable for shared_buffer::SharedBuffer {
     impl_encodable_for_handle!(shared_buffer::SharedBuffer);
 }
 
 impl<T> MojomEncodable for data_pipe::Consumer<T> {
     impl_encodable_for_handle!(data_pipe::Consumer<T>);
 }
 
 impl<T> MojomEncodable for data_pipe::Producer<T> {
     impl_encodable_for_handle!(data_pipe::Producer<T>);
 }
 
 impl MojomEncodable for wait_set::WaitSet {
     impl_encodable_for_handle!(wait_set::WaitSet);
 }