Avoid calling vector resize() with excessive size parameter: fix broken integer overflow checks, or remove resize() calls to simplify non-hot-path cases, or add stronger validations as appropriate.

BUG=31364
TEST=NONE

Review URL: http://codereview.chromium.org/519031

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@35414 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 7 insertions, 13 deletions

diff --git a/ipc/ipc_message_utils.h b/ipc/ipc_message_utils.h
index 76811a7..4f1a6f32 100644
--- a/ipc/ipc_message_utils.h
+++ b/ipc/ipc_message_utils.h
@@ -451,22 +451,16 @@ struct ParamTraits<std::vector<P> > {
   }
   static bool Read(const Message* m, void** iter, param_type* r) {
     int size;
+    // ReadLength() checks for < 0 itself.
     if (!m->ReadLength(iter, &size))
       return false;
     // Resizing beforehand is not safe, see BUG 1006367 for details.
-    if (m->IteratorHasRoomFor(*iter, size * sizeof(P))) {
-      r->resize(size);
-      for (int i = 0; i < size; i++) {
-        if (!ReadParam(m, iter, &(*r)[i]))
-          return false;
-      }
-    } else {
-      for (int i = 0; i < size; i++) {
-        P element;
-        if (!ReadParam(m, iter, &element))
-          return false;
-        r->push_back(element);
-      }
+    if (INT_MAX / sizeof(P) <= static_cast<size_t>(size))
+      return false;
+    r->resize(size);
+    for (int i = 0; i < size; i++) {
+      if (!ReadParam(m, iter, &(*r)[i]))
+        return false;
     }
     return true;
   }