Mojo cpp bindings: validation logic for incoming messages

mojo/public/cpp/bindings/lib/bindings_serialization.h

Index: mojo/public/cpp/bindings/lib/bindings_serialization.h
diff --git a/mojo/public/cpp/bindings/lib/bindings_serialization.h b/mojo/public/cpp/bindings/lib/bindings_serialization.h
index 818d69373910ae10067280330837390cb557bec7..f8a9f139243f845372b5c0d037ba3a65f2942d9a 100644
--- a/mojo/public/cpp/bindings/lib/bindings_serialization.h
+++ b/mojo/public/cpp/bindings/lib/bindings_serialization.h
@@ -13,9 +13,13 @@
 namespace mojo {
 namespace internal {
 
+class BoundsChecker;
+
 size_t Align(size_t size);
 char* AlignPointer(char* ptr);
 
+bool IsAligned(const void* ptr);

[Tom Sepez, 2014/05/22 19:39:21]

nit: is aligned to what? 4? 8? maybe a better name here.

[yzshen1, 2014/05/22 20:56:22]

I agree that it will be more clear as you suggested.
However, it is more consistent with the two methods above this way.

I feel that I probably should rename either all or none of them.

What do you think?

+
 // Pointers are encoded as relative offsets. The offsets are relative to the
 // address of where the offset value is stored, such that the pointer may be
 // recovered with the expression:
@@ -32,6 +36,10 @@ inline void DecodePointer(const uint64_t* offset, T** ptr) {
   *ptr = reinterpret_cast<T*>(const_cast<void*>(DecodePointerRaw(offset)));
 }
 
+// Checks whether decoding the pointer will overflow and produce a poniter

[Tom Sepez, 2014/05/22 19:39:21]

nit: sp. poniter

[yzshen1, 2014/05/22 20:56:22]

Done.

+// smaller than |offset|.
+bool ValidateEncodedPointer(const uint64_t* offset);
+
 // Check that the given pointer references memory contained within the message.
 bool ValidatePointer(const void* ptr, const Message& message);
 
@@ -50,6 +58,8 @@ inline void Encode(T* obj, std::vector<Handle>* handles) {
   EncodePointer(obj->ptr, &obj->offset);
 }
 
+// TODO(yzshen): Remove all redundant validation during decoding. And make
+// Decode*() functions/methods return void.
 template <typename T>
 inline bool Decode(T* obj, Message* message) {
   DecodePointer(&obj->offset, &obj->ptr);
@@ -62,6 +72,13 @@ inline bool Decode(T* obj, Message* message) {
   return true;
 }
 
+// If returns true, this function also claims the memory range of the size
+// specified in the struct header, starting from |data|.
+bool ValidateStructHeader(const void* data,
+                          uint32_t min_num_bytes,
+                          uint32_t min_num_fields,
+                          BoundsChecker* bounds_checker);
+
 }  // namespace internal
 }  // namespace mojo