diff options
| author | jschuh@chromium.org <jschuh@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2012-11-21 00:58:00 +0000 |
|---|---|---|
| committer | jschuh@chromium.org <jschuh@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2012-11-21 00:58:00 +0000 |
| commit | 2e02cfe89cbffc8a0bc1bdaee9efe930fd55e376 (patch) | |
| tree | b017ee97b5825101148794ec79110b11fa4c509c /ipc/ipc_message_utils.cc | |
| parent | c043df27ec2f662aab546db57c90a88ecc02229a (diff) | |
| download | chromium_src-2e02cfe89cbffc8a0bc1bdaee9efe930fd55e376.zip chromium_src-2e02cfe89cbffc8a0bc1bdaee9efe930fd55e376.tar.gz chromium_src-2e02cfe89cbffc8a0bc1bdaee9efe930fd55e376.tar.bz2 | |
Verify lfFaceName is NUL terminated in IPC deserializer.
BUG=162066
Review URL: https://chromiumcodereview.appspot.com/11416115
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@168937 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'ipc/ipc_message_utils.cc')
| -rw-r--r-- | ipc/ipc_message_utils.cc | 17 |
1 files changed, 10 insertions, 7 deletions
diff --git a/ipc/ipc_message_utils.cc b/ipc/ipc_message_utils.cc index 7dfea83..4cc8494 100644 --- a/ipc/ipc_message_utils.cc +++ b/ipc/ipc_message_utils.cc @@ -16,6 +16,8 @@ #if defined(OS_POSIX) #include "ipc/file_descriptor_set_posix.h" +#elif defined(OS_WIN) +#include <tchar.h> #endif namespace IPC { @@ -808,15 +810,16 @@ bool ParamTraits<LOGFONT>::Read(const Message* m, PickleIterator* iter, param_type* r) { const char *data; int data_size = 0; - bool result = m->ReadData(iter, &data, &data_size); - if (result && data_size == sizeof(LOGFONT)) { - memcpy(r, data, sizeof(LOGFONT)); - } else { - result = false; - NOTREACHED(); + if (m->ReadData(iter, &data, &data_size) && data_size == sizeof(LOGFONT)) { + const LOGFONT *font = reinterpret_cast<LOGFONT*>(const_cast<char*>(data)); + if (_tcsnlen(font->lfFaceName, LF_FACESIZE) < LF_FACESIZE) { + memcpy(r, data, sizeof(LOGFONT)); + return true; + } } - return result; + NOTREACHED(); + return false; } void ParamTraits<LOGFONT>::Log(const param_type& p, std::string* l) { |