summaryrefslogtreecommitdiffstats
path: root/content/browser/renderer_host/p2p
diff options
context:
space:
mode:
authorsergeyu@chromium.org <sergeyu@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98>2013-10-13 18:11:15 +0000
committersergeyu@chromium.org <sergeyu@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98>2013-10-13 18:11:15 +0000
commit6a76fde3d6d4c75379146dd4233b19f08f009edd (patch)
tree6384c49caa497f933297e848ea0e9b8909e2c87b /content/browser/renderer_host/p2p
parent2b1a87363cec82bdd0b74ff4f47de5c0e6c96f47 (diff)
downloadchromium_src-6a76fde3d6d4c75379146dd4233b19f08f009edd.zip
chromium_src-6a76fde3d6d4c75379146dd4233b19f08f009edd.tar.gz
chromium_src-6a76fde3d6d4c75379146dd4233b19f08f009edd.tar.bz2
Limit size of outgoing P2P packets
Previously P2PSocketDispatcherHost didn't limit size of packets it receives in P2PHostMsg_Send. Added a limit of 32k. Review URL: https://codereview.chromium.org/27058006 git-svn-id: svn://svn.chromium.org/chrome/trunk/src@228398 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'content/browser/renderer_host/p2p')
-rw-r--r--content/browser/renderer_host/p2p/socket_dispatcher_host.cc12
1 files changed, 12 insertions, 0 deletions
diff --git a/content/browser/renderer_host/p2p/socket_dispatcher_host.cc b/content/browser/renderer_host/p2p/socket_dispatcher_host.cc
index 21463a1..19258f7 100644
--- a/content/browser/renderer_host/p2p/socket_dispatcher_host.cc
+++ b/content/browser/renderer_host/p2p/socket_dispatcher_host.cc
@@ -22,6 +22,8 @@ using content::BrowserThread;
namespace content {
+const size_t kMaximumPacketSize = 32768;
+
class P2PSocketDispatcherHost::DnsRequest {
public:
typedef base::Callback<void(const net::IPAddressNumber&)> DoneCallback;
@@ -227,6 +229,16 @@ void P2PSocketDispatcherHost::OnSend(int socket_id,
LOG(ERROR) << "Received P2PHostMsg_Send for invalid socket_id.";
return;
}
+
+ if (data.size() > kMaximumPacketSize) {
+ LOG(ERROR) << "Received P2PHostMsg_Send with a packet that is too big: "
+ << data.size();
+ Send(new P2PMsg_OnError(socket_id));
+ delete socket;
+ sockets_.erase(socket_id);
+ return;
+ }
+
socket->Send(socket_address, data);
}