Mojo C++ bindings: reject messages version 2 with null payload pointer.

mojo/public/cpp/bindings/lib/message_header_validator.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/public/cpp/bindings/message_header_validator.h"
 
 #include "mojo/public/cpp/bindings/lib/array_internal.h"
 #include "mojo/public/cpp/bindings/lib/validate_params.h"
 #include "mojo/public/cpp/bindings/lib/validation_context.h"
 #include "mojo/public/cpp/bindings/lib/validation_errors.h"
@@ skipping 55 matching lines @@
 
   auto* header_v2 = static_cast<const internal::MessageHeaderV2*>(header);
   // For the payload pointer:
   // - Check that the pointer can be safely decoded.
   // - Claim one byte that the pointer points to. It makes sure not only the
   //   address is within the message, but also the address precedes the array
   //   storing interface IDs (which is important for safely calculating the
   //   payload size).
   // - Validation of the payload contents will be done separately based on the
   //   payload type.
-  if (!header_v2->payload.is_null() &&
-      (!internal::ValidatePointer(header_v2->payload, validation_context) ||
-       !validation_context->ClaimMemory(header_v2->payload.Get(), 1))) {
+  if (!internal::ValidatePointerNonNullable(header_v2->payload,
+                                            "null payload in message header",
+                                            validation_context) ||
+      !internal::ValidatePointer(header_v2->payload, validation_context) ||
+      !validation_context->ClaimMemory(header_v2->payload.Get(), 1)) {
     return false;
   }
 
   const internal::ContainerValidateParams validate_params(0, false, nullptr);
   if (!internal::ValidateContainer(header_v2->payload_interface_ids,
                                    validation_context, &validate_params)) {
     return false;
   }
 
   if (!header_v2->payload_interface_ids.is_null()) {
@@ skipping 35 matching lines @@
                                                     &validation_context))
     return false;
 
   if (!IsValidMessageHeader(message->header(), &validation_context))
     return false;
 
   return true;
 }
 
 }  // namespace mojo