[BlobStorage] Enforcing renderer constraints to prevent broken blobs

third_party/WebKit/Source/platform/blob/BlobData.cpp

Index: third_party/WebKit/Source/platform/blob/BlobData.cpp
diff --git a/third_party/WebKit/Source/platform/blob/BlobData.cpp b/third_party/WebKit/Source/platform/blob/BlobData.cpp
index d3285e23991301742f7e695e4058ee96d65ad9b9..699f20592b085aca6be0501f40df1cca3e2d9760 100644
--- a/third_party/WebKit/Source/platform/blob/BlobData.cpp
+++ b/third_party/WebKit/Source/platform/blob/BlobData.cpp
@@ -113,6 +113,11 @@ void BlobData::appendFile(const String& path,
                           double expectedModificationTime) {
   CHECK_EQ(m_fileComposition, FileCompositionStatus::NO_UNKNOWN_SIZE_FILES)

[pwnall, 2017/02/28 23:37:03]

This CHECK should also be a DCHECK, but it's not introduced in this CL, so I'm
ok with the CHECK being changed in a different CL.

       << "Blobs with a unknown-size file cannot have other items.";
+  DCHECK_NE(length, BlobDataItem::toEndOfFile)
+      << "It is illegal to append file items that have an unknown size. To "
+         "create a blob with a single file with unknown size, use "
+         "BlobData::createForFileWithUnknownSize. Otherwise please provide the "
+         "file size.";
   m_items.push_back(
       BlobDataItem(path, offset, length, expectedModificationTime));
 }
@@ -122,6 +127,8 @@ void BlobData::appendBlob(PassRefPtr<BlobDataHandle> dataHandle,
                           long long length) {
   CHECK_EQ(m_fileComposition, FileCompositionStatus::NO_UNKNOWN_SIZE_FILES)

[pwnall, 2017/02/28 23:37:03]

This CHECK should also be a DCHECK, same comment as above.

       << "Blobs with a unknown-size file cannot have other items.";
+  DCHECK(!dataHandle->isSingleUnknownSizeFile())
+      << "It is illegal to append an unknown size file blob.";
   m_items.push_back(BlobDataItem(std::move(dataHandle), offset, length));
 }
 
@@ -210,14 +217,17 @@ bool BlobData::canConsolidateData(size_t length) {
 }
 
 BlobDataHandle::BlobDataHandle()
-    : m_uuid(createCanonicalUUIDString()), m_size(0) {
+    : m_uuid(createCanonicalUUIDString()),
+      m_size(0),
+      m_isSingleUnknownSizeFile(false) {
   BlobRegistry::registerBlobData(m_uuid, BlobData::create());
 }
 
 BlobDataHandle::BlobDataHandle(std::unique_ptr<BlobData> data, long long size)
     : m_uuid(createCanonicalUUIDString()),
       m_type(data->contentType().isolatedCopy()),
-      m_size(size) {
+      m_size(size),
+      m_isSingleUnknownSizeFile(data->isSingleUnknownSizeFile()) {
   BlobRegistry::registerBlobData(m_uuid, std::move(data));
 }
 
@@ -226,7 +236,8 @@ BlobDataHandle::BlobDataHandle(const String& uuid,
                                long long size)
     : m_uuid(uuid.isolatedCopy()),
       m_type(isValidBlobType(type) ? type.isolatedCopy() : ""),
-      m_size(size) {
+      m_size(size),
+      m_isSingleUnknownSizeFile(false) {
   BlobRegistry::addBlobDataRef(m_uuid);
 }