| Index: mojo/public/cpp/bindings/lib/validation_context.cc
|
| diff --git a/mojo/public/cpp/bindings/lib/validation_context.cc b/mojo/public/cpp/bindings/lib/validation_context.cc
|
| index 435168658a2d984e85d43d2469cf0d1f7aa4f54d..ad0a3646eb87db7569ea75d14f428e1989eb0f10 100644
|
| --- a/mojo/public/cpp/bindings/lib/validation_context.cc
|
| +++ b/mojo/public/cpp/bindings/lib/validation_context.cc
|
| @@ -12,6 +12,7 @@ namespace internal {
|
| ValidationContext::ValidationContext(const void* data,
|
| size_t data_num_bytes,
|
| size_t num_handles,
|
| + size_t num_associated_endpoint_handles,
|
| Message* message,
|
| const base::StringPiece& description,
|
| int stack_depth)
|
| @@ -21,20 +22,25 @@ ValidationContext::ValidationContext(const void* data,
|
| data_end_(data_begin_ + data_num_bytes),
|
| handle_begin_(0),
|
| handle_end_(static_cast<uint32_t>(num_handles)),
|
| + associated_endpoint_handle_begin_(0),
|
| + associated_endpoint_handle_end_(
|
| + static_cast<uint32_t>(num_associated_endpoint_handles)),
|
| stack_depth_(stack_depth) {
|
| + // Check whether the calculation of |data_end_| or static_cast from size_t to
|
| + // uint32_t causes overflow.
|
| + // They shouldn't happen but they do, set the corresponding range to empty.
|
| if (data_end_ < data_begin_) {
|
| - // The calculation of |data_end_| overflowed.
|
| - // It shouldn't happen but if it does, set the range to empty so
|
| - // IsValidRange() and ClaimMemory() always fail.
|
| NOTREACHED();
|
| data_end_ = data_begin_;
|
| }
|
| if (handle_end_ < num_handles) {
|
| - // Assigning |num_handles| to |handle_end_| overflowed.
|
| - // It shouldn't happen but if it does, set the handle index range to empty.
|
| NOTREACHED();
|
| handle_end_ = 0;
|
| }
|
| + if (associated_endpoint_handle_end_ < num_associated_endpoint_handles) {
|
| + NOTREACHED();
|
| + associated_endpoint_handle_end_ = 0;
|
| + }
|
| }
|
|
|
| ValidationContext::~ValidationContext() {
|
|
|