summaryrefslogtreecommitdiffstats
path: root/ipc/ipc_message_utils.cc
diff options
context:
space:
mode:
authorjschuh@chromium.org <jschuh@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98>2012-11-21 00:58:00 +0000
committerjschuh@chromium.org <jschuh@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98>2012-11-21 00:58:00 +0000
commit2e02cfe89cbffc8a0bc1bdaee9efe930fd55e376 (patch)
treeb017ee97b5825101148794ec79110b11fa4c509c /ipc/ipc_message_utils.cc
parentc043df27ec2f662aab546db57c90a88ecc02229a (diff)
downloadchromium_src-2e02cfe89cbffc8a0bc1bdaee9efe930fd55e376.zip
chromium_src-2e02cfe89cbffc8a0bc1bdaee9efe930fd55e376.tar.gz
chromium_src-2e02cfe89cbffc8a0bc1bdaee9efe930fd55e376.tar.bz2
Verify lfFaceName is NUL terminated in IPC deserializer.
BUG=162066 Review URL: https://chromiumcodereview.appspot.com/11416115 git-svn-id: svn://svn.chromium.org/chrome/trunk/src@168937 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'ipc/ipc_message_utils.cc')
-rw-r--r--ipc/ipc_message_utils.cc17
1 files changed, 10 insertions, 7 deletions
diff --git a/ipc/ipc_message_utils.cc b/ipc/ipc_message_utils.cc
index 7dfea83..4cc8494 100644
--- a/ipc/ipc_message_utils.cc
+++ b/ipc/ipc_message_utils.cc
@@ -16,6 +16,8 @@
#if defined(OS_POSIX)
#include "ipc/file_descriptor_set_posix.h"
+#elif defined(OS_WIN)
+#include <tchar.h>
#endif
namespace IPC {
@@ -808,15 +810,16 @@ bool ParamTraits<LOGFONT>::Read(const Message* m, PickleIterator* iter,
param_type* r) {
const char *data;
int data_size = 0;
- bool result = m->ReadData(iter, &data, &data_size);
- if (result && data_size == sizeof(LOGFONT)) {
- memcpy(r, data, sizeof(LOGFONT));
- } else {
- result = false;
- NOTREACHED();
+ if (m->ReadData(iter, &data, &data_size) && data_size == sizeof(LOGFONT)) {
+ const LOGFONT *font = reinterpret_cast<LOGFONT*>(const_cast<char*>(data));
+ if (_tcsnlen(font->lfFaceName, LF_FACESIZE) < LF_FACESIZE) {
+ memcpy(r, data, sizeof(LOGFONT));
+ return true;
+ }
}
- return result;
+ NOTREACHED();
+ return false;
}
void ParamTraits<LOGFONT>::Log(const param_type& p, std::string* l) {