diff options
| author | rkc@chromium.org <rkc@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2012-11-28 22:26:12 +0000 |
|---|---|---|
| committer | rkc@chromium.org <rkc@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2012-11-28 22:26:12 +0000 |
| commit | 0961ea872cfa67a377c0d67ebbfbc4f222ed72d3 (patch) | |
| tree | 5cd11e02cb4cac12722aa8d98b4030f67351b459 /ipc/ipc_channel_reader.cc | |
| parent | f82017820fe06b6dd5fe5a782919971c9e8ff7f4 (diff) | |
| download | chromium_src-0961ea872cfa67a377c0d67ebbfbc4f222ed72d3.zip chromium_src-0961ea872cfa67a377c0d67ebbfbc4f222ed72d3.tar.gz chromium_src-0961ea872cfa67a377c0d67ebbfbc4f222ed72d3.tar.bz2 | |
Fix check for maximum IPC message size.
If the incoming message length is larger than Channel::kMaximumMessageSize, the RHS for the check for message size will become negative - since both sides are promoted to unsigned, the negative will simply become a very large value hence breaking the check.
R=tsepez@chromium.org
BUG=None.
Review URL: https://codereview.chromium.org/11413204
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@170072 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'ipc/ipc_channel_reader.cc')
| -rw-r--r-- | ipc/ipc_channel_reader.cc | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/ipc/ipc_channel_reader.cc b/ipc/ipc_channel_reader.cc index 4c3a86b..9055deb 100644 --- a/ipc/ipc_channel_reader.cc +++ b/ipc/ipc_channel_reader.cc @@ -53,8 +53,8 @@ bool ChannelReader::DispatchInputData(const char* input_data, p = input_data; end = input_data + input_data_len; } else { - if (input_overflow_buf_.size() > - Channel::kMaximumMessageSize - input_data_len) { + if (input_overflow_buf_.size() + input_data_len > + Channel::kMaximumMessageSize) { input_overflow_buf_.clear(); LOG(ERROR) << "IPC message is too big"; return false; |