Index: ipc/ipc_message_utils.cc |
diff --git a/ipc/ipc_message_utils.cc b/ipc/ipc_message_utils.cc |
index 1a7966e8a14610e0df2bc13b412ea7d15a8f056a..e3a3d5e20c720cf6d830ac931e843079ef5fc0b8 100644 |
--- a/ipc/ipc_message_utils.cc |
+++ b/ipc/ipc_message_utils.cc |
@@ -568,6 +568,8 @@ bool ParamTraits<std::vector<bool>>::Read(const base::Pickle* m, |
// ReadLength() checks for < 0 itself. |
if (!iter->ReadLength(&size)) |
return false; |
+ if (!IsPickleSizeSufficient<bool>(m, size)) |
+ return false; |
r->resize(size); |
for (int i = 0; i < size; i++) { |
bool value; |