diff options
| author | cevans@chromium.org <cevans@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2009-06-25 16:54:02 +0000 |
|---|---|---|
| committer | cevans@chromium.org <cevans@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2009-06-25 16:54:02 +0000 |
| commit | 8766556dd35a7295e2aef849a3ba33bedaa1106a (patch) | |
| tree | 69e7b17f20b8c6c8b69326c1578d94637073cd8e /base/pickle.cc | |
| parent | 638d35291e4a0e5e1ff6275e01296362ce4292be (diff) | |
| download | chromium_src-8766556dd35a7295e2aef849a3ba33bedaa1106a.zip chromium_src-8766556dd35a7295e2aef849a3ba33bedaa1106a.tar.gz chromium_src-8766556dd35a7295e2aef849a3ba33bedaa1106a.tar.bz2 | |
Fix a couple of integer issues in Pickle deserialization. Neither represent
a significant risk because the code is not directly exposed to user input. In
addition, neither error leads to memory corruption. At worse, there's a C++
exception or abort().
BUG=NONE
TEST=PickleTest.EvilLengths
Review URL: http://codereview.chromium.org/146121
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@19249 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'base/pickle.cc')
| -rw-r--r-- | base/pickle.cc | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/base/pickle.cc b/base/pickle.cc index 5e249c7..c3df8bc 100644 --- a/base/pickle.cc +++ b/base/pickle.cc @@ -208,6 +208,9 @@ bool Pickle::ReadWString(void** iter, std::wstring* result) const { int len; if (!ReadLength(iter, &len)) return false; + // Avoid integer overflow. + if (len > INT_MAX / static_cast<int>(sizeof(wchar_t))) + return false; if (!IteratorHasRoomFor(*iter, len * sizeof(wchar_t))) return false; @@ -224,7 +227,7 @@ bool Pickle::ReadString16(void** iter, string16* result) const { int len; if (!ReadLength(iter, &len)) return false; - if (!IteratorHasRoomFor(*iter, len)) + if (!IteratorHasRoomFor(*iter, len * sizeof(char16))) return false; char16* chars = reinterpret_cast<char16*>(*iter); |