Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(199)

Unified Diff: ipc/ipc_message_utils.h

Issue 2968003005: Support Serializing and Deserializing RepeatedField / RepeatedPtrField in IPC::Message (Closed)
Patch Set: Update IsPickleSizeSufficent to avoid GetSize Created 3 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « ipc/ipc_message_repeated_field_utils_unittest.cc ('k') | ipc/ipc_message_utils.cc » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: ipc/ipc_message_utils.h
diff --git a/ipc/ipc_message_utils.h b/ipc/ipc_message_utils.h
index 348ff7eb61aacaff93f43de283e7c1c9f3bfd687..2f37dc51be0439b2d4b4ca07d8953c6b49aa9cae 100644
--- a/ipc/ipc_message_utils.h
+++ b/ipc/ipc_message_utils.h
@@ -120,6 +120,38 @@ static inline void LogParam(const P& p, std::string* l) {
ParamTraits<Type>::Log(static_cast<const Type& >(p), l);
}
+// Checks whether |m| is sufficient to carry |count| elements. This function
+// cannot guarantee the |m| contains valid data to be deserialized. |raw_size|
+// is the size of bytes needed for one element in the memory.
+static inline bool IsPickleSizeSufficient(const base::Pickle* m,
dcheng 2017/07/12 08:52:14 OK, sorry. I think I probably didn't do a good job
Hzj_jie 2017/07/13 00:01:03 This change has been reverted. Instead a bug http:
+ int count,
+ int raw_size) {
+ DCHECK(raw_size > 0);
+ if (count < 0)
+ return false;
+ // Rejects if count * raw_size is overflow. See BUG 1006367 for details.
dcheng 2017/07/12 08:52:14 So we have to spelunk a bit into proto details her
Hzj_jie 2017/07/13 00:01:03 Acknowledged.
+ if (INT_MAX / raw_size < count)
+ return false;
+ // TODO(zijiehe): Find a better way to analyze the minimum bytes needed for
+ // each element in the Pickle. Now we assume the size is 1. Note:
+ // ParamTraits<T> may not implement GetSize() function.
+ if (static_cast<size_t>(count) > m->payload_size())
dcheng 2017/07/12 08:52:15 I think it's OK if we omit this check; the importa
Hzj_jie 2017/07/13 00:01:03 Acknowledged.
+ return false;
+ return true;
+}
+
+// Checks whether |m| is sufficient to carry |count| * P data.
+template <class P>
+static inline bool IsPickleSizeSufficient(const base::Pickle* m, int count) {
+ return IsPickleSizeSufficient(m, count, sizeof(P));
+}
+
+// Checks whether |m| is sufficient to carry |count| * (A + B) data.
+template <class A, class B>
+static inline bool IsPickleSizeSufficient(const base::Pickle* m, int count) {
+ return IsPickleSizeSufficient(m, count, sizeof(A) + sizeof(B));
+}
+
// Primitive ParamTraits -------------------------------------------------------
template <>
@@ -427,8 +459,7 @@ struct ParamTraits<std::vector<P>> {
// ReadLength() checks for < 0 itself.
if (!iter->ReadLength(&size))
return false;
- // Resizing beforehand is not safe, see BUG 1006367 for details.
- if (INT_MAX / sizeof(P) <= static_cast<size_t>(size))
+ if (!IsPickleSizeSufficient<P>(m, size))
return false;
r->resize(size);
for (int i = 0; i < size; i++) {
@@ -467,6 +498,8 @@ struct ParamTraits<std::set<P> > {
int size;
if (!iter->ReadLength(&size))
return false;
+ if (!IsPickleSizeSufficient<P>(m, size))
+ return false;
for (int i = 0; i < size; ++i) {
P item;
if (!ReadParam(m, iter, &item))
@@ -503,7 +536,9 @@ struct ParamTraits<std::map<K, V, C, A> > {
base::PickleIterator* iter,
param_type* r) {
int size;
- if (!ReadParam(m, iter, &size) || size < 0)
+ if (!iter->ReadLength(&size))
+ return false;
+ if (!IsPickleSizeSufficient<K, V>(m, size))
return false;
for (int i = 0; i < size; ++i) {
K k;
@@ -894,6 +929,9 @@ struct ParamTraits<base::flat_map<Key, Mapped, Compare>> {
if (!iter->ReadLength(&size))
return false;
+ if (!IsPickleSizeSufficient<Key, Mapped>(m, size))
+ return false;
+
// Construct by creating in a vector and moving into the flat_map. Properly
// serialized flat_maps will be in-order so this will be O(n). Incorrectly
// serialized ones will still be handled properly.
« no previous file with comments | « ipc/ipc_message_repeated_field_utils_unittest.cc ('k') | ipc/ipc_message_utils.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698