Allow data URL > 2MB for loadDataWithBaseURL

content/common/content_param_traits.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/content_param_traits.h"
 
 #include "base/strings/string_number_conversions.h"
 #include "content/common/input/web_input_event_traits.h"
 #include "net/base/ip_endpoint.h"
 #include "ui/gfx/range/range.h"
 
 namespace IPC {
 
+void ParamTraits<scoped_refptr<base::RefCountedMemory> >::Write(
+    Message* m,
+    const param_type& p) {
+  const char* data = NULL;
+  size_t size = 0;
+  if (p.get()) {
+    data = reinterpret_cast<const char*>(p->front());
+    size = p->size();
+  }
+  m->WriteData(data, size);
+}
+
+bool ParamTraits<scoped_refptr<base::RefCountedMemory> >::Read(
+    const Message* m,
+    PickleIterator* iter,
+    param_type* p) {
+  const char* data;
+  int len;
+  if (!m->ReadData(iter, &data, &len))
+    return false;
+  if (len > 0) {
+    scoped_refptr<base::RefCountedString> res = new base::RefCountedString;
+    res->data().assign(data, len);

[jln (very slow on Chromium), 2013/12/02 23:05:25]

This clearly needs a reasonable limit on len.

This would allow an attacker to trivially spray the address space of another
process.

[joth, 2013/12/02 23:21:38]

Good point.

The required use-case is only for sending the data payload from browser ->
renderer. unfortunately by the time it gets to this layer, that direction
information is lost

Further, we only need this support for android webview, which runs in single
process mode so this level of memory protection between renderer and browser is
moot. Again, by the time we get down to this layer that point is also moot.

I'll have to have a think if there's a sensible way to reduce the scope of this
patch to the interesting scenarios then.

+    *p = res;
+  } else {
+    *p = NULL;
+  }
+  return true;
+}
+
+void ParamTraits<scoped_refptr<base::RefCountedMemory> >::Log(
+    const param_type& p, std::string* l) {
+  l->append("(RefCountedMemory)");
+}
+
 void ParamTraits<net::IPEndPoint>::Write(Message* m, const param_type& p) {
   WriteParam(m, p.address());
   WriteParam(m, p.port());
 }
 
 bool ParamTraits<net::IPEndPoint>::Read(const Message* m, PickleIterator* iter,
                                         param_type* p) {
   net::IPAddressNumber address;
   int port;
   if (!ReadParam(m, iter, &address) || !ReadParam(m, iter, &port))
@@ skipping 85 matching lines @@
 #undef CONTENT_COMMON_CONTENT_PARAM_TRAITS_MACROS_H_
 #include "content/common/content_param_traits_macros.h"
 }  // namespace IPC
 
 // Generate param traits log methods.
 #include "ipc/param_traits_log_macros.h"
 namespace IPC {
 #undef CONTENT_COMMON_CONTENT_PARAM_TRAITS_MACROS_H_
 #include "content/common/content_param_traits_macros.h"
 }  // namespace IPC