Index: ipc/ipc_message_utils.h |
diff --git a/ipc/ipc_message_utils.h b/ipc/ipc_message_utils.h |
index 348ff7eb61aacaff93f43de283e7c1c9f3bfd687..2f37dc51be0439b2d4b4ca07d8953c6b49aa9cae 100644 |
--- a/ipc/ipc_message_utils.h |
+++ b/ipc/ipc_message_utils.h |
@@ -120,6 +120,38 @@ static inline void LogParam(const P& p, std::string* l) { |
ParamTraits<Type>::Log(static_cast<const Type& >(p), l); |
} |
+// Checks whether |m| is sufficient to carry |count| elements. This function |
+// cannot guarantee the |m| contains valid data to be deserialized. |raw_size| |
+// is the size of bytes needed for one element in the memory. |
+static inline bool IsPickleSizeSufficient(const base::Pickle* m, |
dcheng
2017/07/12 08:52:14
OK, sorry. I think I probably didn't do a good job
Hzj_jie
2017/07/13 00:01:03
This change has been reverted. Instead a bug http:
|
+ int count, |
+ int raw_size) { |
+ DCHECK(raw_size > 0); |
+ if (count < 0) |
+ return false; |
+ // Rejects if count * raw_size is overflow. See BUG 1006367 for details. |
dcheng
2017/07/12 08:52:14
So we have to spelunk a bit into proto details her
Hzj_jie
2017/07/13 00:01:03
Acknowledged.
|
+ if (INT_MAX / raw_size < count) |
+ return false; |
+ // TODO(zijiehe): Find a better way to analyze the minimum bytes needed for |
+ // each element in the Pickle. Now we assume the size is 1. Note: |
+ // ParamTraits<T> may not implement GetSize() function. |
+ if (static_cast<size_t>(count) > m->payload_size()) |
dcheng
2017/07/12 08:52:15
I think it's OK if we omit this check; the importa
Hzj_jie
2017/07/13 00:01:03
Acknowledged.
|
+ return false; |
+ return true; |
+} |
+ |
+// Checks whether |m| is sufficient to carry |count| * P data. |
+template <class P> |
+static inline bool IsPickleSizeSufficient(const base::Pickle* m, int count) { |
+ return IsPickleSizeSufficient(m, count, sizeof(P)); |
+} |
+ |
+// Checks whether |m| is sufficient to carry |count| * (A + B) data. |
+template <class A, class B> |
+static inline bool IsPickleSizeSufficient(const base::Pickle* m, int count) { |
+ return IsPickleSizeSufficient(m, count, sizeof(A) + sizeof(B)); |
+} |
+ |
// Primitive ParamTraits ------------------------------------------------------- |
template <> |
@@ -427,8 +459,7 @@ struct ParamTraits<std::vector<P>> { |
// ReadLength() checks for < 0 itself. |
if (!iter->ReadLength(&size)) |
return false; |
- // Resizing beforehand is not safe, see BUG 1006367 for details. |
- if (INT_MAX / sizeof(P) <= static_cast<size_t>(size)) |
+ if (!IsPickleSizeSufficient<P>(m, size)) |
return false; |
r->resize(size); |
for (int i = 0; i < size; i++) { |
@@ -467,6 +498,8 @@ struct ParamTraits<std::set<P> > { |
int size; |
if (!iter->ReadLength(&size)) |
return false; |
+ if (!IsPickleSizeSufficient<P>(m, size)) |
+ return false; |
for (int i = 0; i < size; ++i) { |
P item; |
if (!ReadParam(m, iter, &item)) |
@@ -503,7 +536,9 @@ struct ParamTraits<std::map<K, V, C, A> > { |
base::PickleIterator* iter, |
param_type* r) { |
int size; |
- if (!ReadParam(m, iter, &size) || size < 0) |
+ if (!iter->ReadLength(&size)) |
+ return false; |
+ if (!IsPickleSizeSufficient<K, V>(m, size)) |
return false; |
for (int i = 0; i < size; ++i) { |
K k; |
@@ -894,6 +929,9 @@ struct ParamTraits<base::flat_map<Key, Mapped, Compare>> { |
if (!iter->ReadLength(&size)) |
return false; |
+ if (!IsPickleSizeSufficient<Key, Mapped>(m, size)) |
+ return false; |
+ |
// Construct by creating in a vector and moving into the flat_map. Properly |
// serialized flat_maps will be in-order so this will be O(n). Incorrectly |
// serialized ones will still be handled properly. |