| Index: third_party/mojo/src/mojo/public/cpp/bindings/lib/message_header_validator.cc
|
| diff --git a/third_party/mojo/src/mojo/public/cpp/bindings/lib/message_header_validator.cc b/third_party/mojo/src/mojo/public/cpp/bindings/lib/message_header_validator.cc
|
| index 9d28ecc0b80adfc1906ea3983adf87a189e7d0bd..fdcc365aa548588e9a762f729235d5eab4f631d1 100644
|
| --- a/third_party/mojo/src/mojo/public/cpp/bindings/lib/message_header_validator.cc
|
| +++ b/third_party/mojo/src/mojo/public/cpp/bindings/lib/message_header_validator.cc
|
| @@ -17,17 +17,21 @@ bool IsValidMessageHeader(const MessageHeader* header) {
|
| // header. If we encounter fields we do not understand, we must ignore them.
|
|
|
| // Extra validation of the struct header:
|
| - if (header->num_fields == 2) {
|
| + if (header->version < 2) {
|
| + ReportValidationError(VALIDATION_ERROR_UNEXPECTED_STRUCT_HEADER);
|
| + return false;
|
| + }
|
| + if (header->version == 2) {
|
| if (header->num_bytes != sizeof(MessageHeader)) {
|
| ReportValidationError(VALIDATION_ERROR_UNEXPECTED_STRUCT_HEADER);
|
| return false;
|
| }
|
| - } else if (header->num_fields == 3) {
|
| + } else if (header->version == 3) {
|
| if (header->num_bytes != sizeof(MessageHeaderWithRequestID)) {
|
| ReportValidationError(VALIDATION_ERROR_UNEXPECTED_STRUCT_HEADER);
|
| return false;
|
| }
|
| - } else if (header->num_fields > 3) {
|
| + } else if (header->version > 3) {
|
| if (header->num_bytes < sizeof(MessageHeaderWithRequestID)) {
|
| ReportValidationError(VALIDATION_ERROR_UNEXPECTED_STRUCT_HEADER);
|
| return false;
|
| @@ -37,8 +41,8 @@ bool IsValidMessageHeader(const MessageHeader* header) {
|
| // Validate flags (allow unknown bits):
|
|
|
| // These flags require a RequestID.
|
| - if (header->num_fields < 3 && ((header->flags & kMessageExpectsResponse) ||
|
| - (header->flags & kMessageIsResponse))) {
|
| + if (header->version < 3 && ((header->flags & kMessageExpectsResponse) ||
|
| + (header->flags & kMessageIsResponse))) {
|
| ReportValidationError(VALIDATION_ERROR_MESSAGE_HEADER_MISSING_REQUEST_ID);
|
| return false;
|
| }
|
| @@ -65,10 +69,8 @@ bool MessageHeaderValidator::Accept(Message* message) {
|
| // if |message| contains handles.
|
| BoundsChecker bounds_checker(message->data(), message->data_num_bytes(), 0);
|
|
|
| - if (!ValidateStructHeader(
|
| - message->data(), sizeof(MessageHeader), 2, &bounds_checker)) {
|
| + if (!ValidateStructHeaderAndClaimMemory(message->data(), &bounds_checker))
|
| return false;
|
| - }
|
|
|
| if (!IsValidMessageHeader(message->header()))
|
| return false;
|
|
|