Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1517)

Unified Diff: mojo/public/cpp/bindings/lib/validation_util.cc

Issue 2286513002: Mojo C++ bindings: fix inlined union validation. (Closed)
Patch Set: add a test case Created 4 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: mojo/public/cpp/bindings/lib/validation_util.cc
diff --git a/mojo/public/cpp/bindings/lib/validation_util.cc b/mojo/public/cpp/bindings/lib/validation_util.cc
index 4a7e30563ed16af98cc69174bee9b2220e044b21..4824477272e24d796d1c2303ea69a64b79de59ca 100644
--- a/mojo/public/cpp/bindings/lib/validation_util.cc
+++ b/mojo/public/cpp/bindings/lib/validation_util.cc
@@ -46,20 +46,17 @@ bool ValidateStructHeaderAndClaimMemory(const void* data,
return true;
}
-bool ValidateUnionHeaderAndClaimMemory(const void* data,
- bool inlined,
- ValidationContext* validation_context) {
+bool ValidateNonInlinedUnionHeaderAndClaimMemory(
+ const void* data,
+ ValidationContext* validation_context) {
if (!IsAligned(data)) {
ReportValidationError(validation_context,
VALIDATION_ERROR_MISALIGNED_OBJECT);
return false;
}
- // If the union is inlined in another structure its memory was already
- // claimed.
- // This ONLY applies to the union itself, NOT anything which the union points
- // to.
- if (!inlined && !validation_context->ClaimMemory(data, kUnionDataSize)) {
+ if (!validation_context->ClaimMemory(data, kUnionDataSize) ||
+ *static_cast<const uint32_t*>(data) != kUnionDataSize) {
ReportValidationError(validation_context,
VALIDATION_ERROR_ILLEGAL_MEMORY_RANGE);
return false;

Powered by Google App Engine
This is Rietveld 408576698