Mojo C++ bindings: reject messages version 2 with null payload pointer.

mojo/public/cpp/bindings/lib/message.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/public/cpp/bindings/message.h"
 
 #include <stddef.h>
 #include <stdint.h>
 #include <stdlib.h>
 
@@ skipping 62 matching lines @@
                                         std::vector<Handle>* handles) {
   DCHECK(!buffer_);
   buffer_.reset(new internal::MessageBuffer(std::move(message), num_bytes));
   handles_.swap(*handles);
 }
 
 const uint8_t* Message::payload() const {
   if (version() < 2)
     return data() + header()->num_bytes;
 
+  DCHECK(!header_v2()->payload.is_null());
   return static_cast<const uint8_t*>(header_v2()->payload.Get());
 }
 
 uint32_t Message::payload_num_bytes() const {
   DCHECK_GE(data_num_bytes(), header()->num_bytes);
   size_t num_bytes;
   if (version() < 2) {
     num_bytes = data_num_bytes() - header()->num_bytes;
   } else {
-    auto payload = reinterpret_cast<uintptr_t>(header_v2()->payload.Get());
-    if (!payload) {
-      num_bytes = 0;
-    } else {
-      auto payload_end =
-          reinterpret_cast<uintptr_t>(header_v2()->payload_interface_ids.Get());
-      if (!payload_end)
-        payload_end = reinterpret_cast<uintptr_t>(data() + data_num_bytes());
-      DCHECK_GE(payload_end, payload);
-      num_bytes = payload_end - payload;
-    }
+    auto payload_begin =
+        reinterpret_cast<uintptr_t>(header_v2()->payload.Get());
+    auto payload_end =
+        reinterpret_cast<uintptr_t>(header_v2()->payload_interface_ids.Get());
+    if (!payload_end)
+      payload_end = reinterpret_cast<uintptr_t>(data() + data_num_bytes());
+    DCHECK_GE(payload_end, payload_begin);
+    num_bytes = payload_end - payload_begin;
   }
   DCHECK_LE(num_bytes, std::numeric_limits<uint32_t>::max());
   return static_cast<uint32_t>(num_bytes);
 }
 
 uint32_t Message::payload_num_interface_ids() const {
   auto* array_pointer =
       version() < 2 ? nullptr : header_v2()->payload_interface_ids.Get();
   return array_pointer ? static_cast<uint32_t>(array_pointer->size()) : 0;
 }
@@ skipping 210 matching lines @@
 // static
 void SyncMessageResponseSetup::SetCurrentSyncResponseMessage(Message* message) {
   SyncMessageResponseContext* context = SyncMessageResponseContext::current();
   if (context)
     context->response_ = std::move(*message);
 }
 
 }  // namespace internal
 
 }  // namespace mojo