diff options
| author | estade@chromium.org <estade@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2009-03-25 19:46:55 +0000 |
|---|---|---|
| committer | estade@chromium.org <estade@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2009-03-25 19:46:55 +0000 |
| commit | 059292e77d7fcfbf930ccb8cafdaaadd7a505a2e (patch) | |
| tree | ca5d39357661d99cf7a716b6be4ab3fccca36d92 | |
| parent | 98b3860142549f66f841c1a073182628a05a823e (diff) | |
| download | chromium_src-059292e77d7fcfbf930ccb8cafdaaadd7a505a2e.zip chromium_src-059292e77d7fcfbf930ccb8cafdaaadd7a505a2e.tar.gz chromium_src-059292e77d7fcfbf930ccb8cafdaaadd7a505a2e.tar.bz2 | |
Validate clipboard bitmap size data.
Review URL: http://codereview.chromium.org/53040
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@12484 0039d316-1c4b-4281-b951-d872f2087c98
| -rw-r--r-- | base/clipboard.cc | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/base/clipboard.cc b/base/clipboard.cc index 8349b3d..e41fd93 100644 --- a/base/clipboard.cc +++ b/base/clipboard.cc @@ -6,6 +6,18 @@ #include "base/logging.h" +namespace { + +// A compromised renderer could send us bad data, so validate it. +bool IsBitmapSafe(const Clipboard::ObjectMapParams& params) { + const gfx::Size* size = + reinterpret_cast<const gfx::Size*>(&(params[1].front())); + return params[0].size() == + static_cast<size_t>(size->width() * size->height() * 4); +} + +} + void Clipboard::DispatchObject(ObjectType type, const ObjectMapParams& params) { switch (type) { case CBF_TEXT: @@ -40,6 +52,8 @@ void Clipboard::DispatchObject(ObjectType type, const ObjectMapParams& params) { #if defined(OS_WIN) || defined(OS_LINUX) case CBF_BITMAP: + if (!IsBitmapSafe(params)) + return; WriteBitmap(&(params[0].front()), &(params[1].front())); break; #endif // defined(OS_WIN) || defined(OS_LINUX) |