Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(76)

Issue 589183002: Fix boundary check problems in socket_host.cc. (Closed)

Created:
6 years, 3 months ago by jiayl
Modified:
6 years, 3 months ago
CC:
chromium-reviews, darin-cc_chromium.org, jam, palmer, juberti2
Base URL:
https://chromium.googlesource.com/chromium/src.git@master
Project:
chromium
Visibility:
Public.

Description

Fix boundary check problems in socket_host.cc. See the bug for the full list of security issues fixed. BUG=416528 Committed: https://crrev.com/08f0eac49f32b8d24c82bd5cc884938eb494f85e Cr-Commit-Position: refs/heads/master@{#296287}

Patch Set 1 #

Total comments: 28

Patch Set 2 : address palmer and aedla's comments #

Total comments: 2

Patch Set 3 : for justin's #

Total comments: 4

Patch Set 4 : #

Total comments: 20

Patch Set 5 : rename and nits #

Total comments: 3

Patch Set 6 : nit #

Patch Set 7 : #

Unified diffs Side-by-side diffs Delta from patch set Stats (+228 lines, -155 lines) Patch
M content/browser/renderer_host/p2p/socket_host.h View 1 2 3 4 1 chunk +12 lines, -8 lines 0 comments Download
M content/browser/renderer_host/p2p/socket_host.cc View 1 2 3 4 5 6 21 chunks +164 lines, -103 lines 0 comments Download
M content/browser/renderer_host/p2p/socket_host_unittest.cc View 1 2 3 4 2 chunks +52 lines, -44 lines 0 comments Download

Messages

Total messages: 27 (6 generated)
jiayl
P0 needed for M38. PTAL.
6 years, 3 months ago (2014-09-22 18:32:23 UTC) #2
Sergey Ulanov
On 2014/09/22 18:32:23, jiayl wrote: > P0 needed for M38. > PTAL. Please CC me ...
6 years, 3 months ago (2014-09-22 19:25:45 UTC) #3
palmer
I am contractually obligated to each lunch now. But, this file has Integer Issues. https://codereview.chromium.org/589183002/diff/1/content/browser/renderer_host/p2p/socket_host.cc ...
6 years, 3 months ago (2014-09-22 19:34:46 UTC) #5
aedla
Some comments from me as well. https://codereview.chromium.org/589183002/diff/1/content/browser/renderer_host/p2p/socket_host.cc File content/browser/renderer_host/p2p/socket_host.cc (right): https://codereview.chromium.org/589183002/diff/1/content/browser/renderer_host/p2p/socket_host.cc#newcode90 content/browser/renderer_host/p2p/socket_host.cc:90: uint16 extn_length = ...
6 years, 3 months ago (2014-09-22 20:06:48 UTC) #7
jiayl
All comments addressed. PTAL. https://codereview.chromium.org/589183002/diff/1/content/browser/renderer_host/p2p/socket_host.cc File content/browser/renderer_host/p2p/socket_host.cc (right): https://codereview.chromium.org/589183002/diff/1/content/browser/renderer_host/p2p/socket_host.cc#newcode36 content/browser/renderer_host/p2p/socket_host.cc:36: bool IsTurnChannelData(const char* data, int ...
6 years, 3 months ago (2014-09-22 21:39:03 UTC) #8
juberti2
https://codereview.chromium.org/589183002/diff/1/content/browser/renderer_host/p2p/socket_host.cc File content/browser/renderer_host/p2p/socket_host.cc (right): https://codereview.chromium.org/589183002/diff/1/content/browser/renderer_host/p2p/socket_host.cc#newcode37 content/browser/renderer_host/p2p/socket_host.cc:37: return len >= 1 && ((*data & 0xC0) == ...
6 years, 3 months ago (2014-09-22 22:43:57 UTC) #10
jiayl
https://codereview.chromium.org/589183002/diff/1/content/browser/renderer_host/p2p/socket_host.cc File content/browser/renderer_host/p2p/socket_host.cc (right): https://codereview.chromium.org/589183002/diff/1/content/browser/renderer_host/p2p/socket_host.cc#newcode37 content/browser/renderer_host/p2p/socket_host.cc:37: return len >= 1 && ((*data & 0xC0) == ...
6 years, 3 months ago (2014-09-22 23:04:13 UTC) #11
juberti2
https://codereview.chromium.org/589183002/diff/40001/content/browser/renderer_host/p2p/socket_host.cc File content/browser/renderer_host/p2p/socket_host.cc (right): https://codereview.chromium.org/589183002/diff/40001/content/browser/renderer_host/p2p/socket_host.cc#newcode22 content/browser/renderer_host/p2p/socket_host.cc:22: const int kMinRtpHdrLen = 12; should these all become ...
6 years, 3 months ago (2014-09-22 23:07:01 UTC) #12
jiayl
https://codereview.chromium.org/589183002/diff/40001/content/browser/renderer_host/p2p/socket_host.cc File content/browser/renderer_host/p2p/socket_host.cc (right): https://codereview.chromium.org/589183002/diff/40001/content/browser/renderer_host/p2p/socket_host.cc#newcode22 content/browser/renderer_host/p2p/socket_host.cc:22: const int kMinRtpHdrLen = 12; On 2014/09/22 23:07:01, juberti2 ...
6 years, 3 months ago (2014-09-22 23:16:35 UTC) #13
juberti2
lgtm
6 years, 3 months ago (2014-09-22 23:22:07 UTC) #14
jiayl
Ping sergeyu.
6 years, 3 months ago (2014-09-23 15:41:24 UTC) #15
jiayl
Ping palmer and aedla. Do you want to take another look?
6 years, 3 months ago (2014-09-23 18:20:51 UTC) #16
Sergey Ulanov
https://codereview.chromium.org/589183002/diff/60001/content/browser/renderer_host/p2p/socket_host.cc File content/browser/renderer_host/p2p/socket_host.cc (right): https://codereview.chromium.org/589183002/diff/60001/content/browser/renderer_host/p2p/socket_host.cc#newcode22 content/browser/renderer_host/p2p/socket_host.cc:22: const size_t kMinRtpHdrLen = 12; Not related to this ...
6 years, 3 months ago (2014-09-23 18:38:08 UTC) #17
palmer
https://codereview.chromium.org/589183002/diff/60001/content/browser/renderer_host/p2p/socket_host.cc File content/browser/renderer_host/p2p/socket_host.cc (right): https://codereview.chromium.org/589183002/diff/60001/content/browser/renderer_host/p2p/socket_host.cc#newcode72 content/browser/renderer_host/p2p/socket_host.cc:72: size_t cc_count = rtp[0] & 0x0F; > Do you ...
6 years, 3 months ago (2014-09-23 18:57:32 UTC) #18
jiayl
PTAL! https://codereview.chromium.org/589183002/diff/60001/content/browser/renderer_host/p2p/socket_host.cc File content/browser/renderer_host/p2p/socket_host.cc (right): https://codereview.chromium.org/589183002/diff/60001/content/browser/renderer_host/p2p/socket_host.cc#newcode22 content/browser/renderer_host/p2p/socket_host.cc:22: const size_t kMinRtpHdrLen = 12; On 2014/09/23 18:38:08, ...
6 years, 3 months ago (2014-09-23 19:59:31 UTC) #19
Sergey Ulanov
lgtm
6 years, 3 months ago (2014-09-23 20:35:38 UTC) #20
palmer
This was a lot of work. Thank you! LGTM, but let's see if aedla has ...
6 years, 3 months ago (2014-09-23 20:58:08 UTC) #21
juri.aedla
Looking nice, thanks. LGTM https://codereview.chromium.org/589183002/diff/80001/content/browser/renderer_host/p2p/socket_host.cc File content/browser/renderer_host/p2p/socket_host.cc (right): https://codereview.chromium.org/589183002/diff/80001/content/browser/renderer_host/p2p/socket_host.cc#newcode304 content/browser/renderer_host/p2p/socket_host.cc:304: while (packet + rtp_begin < ...
6 years, 3 months ago (2014-09-23 21:11:04 UTC) #23
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/589183002/120001
6 years, 3 months ago (2014-09-23 21:22:02 UTC) #25
commit-bot: I haz the power
Committed patchset #7 (id:120001) as b5a185836c2aa532a9a6305b0280411ee95f1f4e
6 years, 3 months ago (2014-09-23 22:44:52 UTC) #26
commit-bot: I haz the power
6 years, 3 months ago (2014-09-23 22:45:30 UTC) #27
Message was sent while issue was closed.
Patchset 7 (id:??) landed as
https://crrev.com/08f0eac49f32b8d24c82bd5cc884938eb494f85e
Cr-Commit-Position: refs/heads/master@{#296287}

Powered by Google App Engine
This is Rietveld 408576698