diff options
| -rw-r--r-- | ipc/ipc_channel_posix.cc | 13 | ||||
| -rw-r--r-- | ipc/ipc_channel_win.cc | 14 | ||||
| -rw-r--r-- | ipc/ipc_sync_channel.cc | 9 |
3 files changed, 36 insertions, 0 deletions
diff --git a/ipc/ipc_channel_posix.cc b/ipc/ipc_channel_posix.cc index 545ad0c..4e00964 100644 --- a/ipc/ipc_channel_posix.cc +++ b/ipc/ipc_channel_posix.cc @@ -734,6 +734,10 @@ bool Channel::ChannelImpl::ProcessOutgoingMessages() { while (!output_queue_.empty()) { Message* msg = output_queue_.front(); + // Oversized messages should be rejected in Send(). + DCHECK_LE(msg->size(), kMaximumMessageSize) + << "Attempt to send oversized message"; + #if defined(OS_LINUX) scoped_ptr<Message> hello; if (remote_fd_pipe_ != -1 && @@ -884,6 +888,15 @@ bool Channel::ChannelImpl::ProcessOutgoingMessages() { } bool Channel::ChannelImpl::Send(Message* message) { + if(message->size(), kMaximumMessageSize) { + LOG(ERROR) << "Attempt to send oversized message " + << message->size() + << " type=" + << message->type(); + Close(); + delete message; + return false; + } #ifdef IPC_MESSAGE_DEBUG_EXTRA DLOG(INFO) << "sending message @" << message << " on channel @" << this << " with type " << message->type() diff --git a/ipc/ipc_channel_win.cc b/ipc/ipc_channel_win.cc index 701bce8..788a2aa 100644 --- a/ipc/ipc_channel_win.cc +++ b/ipc/ipc_channel_win.cc @@ -77,6 +77,15 @@ void Channel::ChannelImpl::Close() { bool Channel::ChannelImpl::Send(Message* message) { DCHECK(thread_check_->CalledOnValidThread()); + if (message->size() > kMaximumMessageSize) { + LOG(ERROR) << "Attempt to send oversized message " + << message->size() + << " type=" + << message->type(); + Close(); + delete message; + return false; + } #ifdef IPC_MESSAGE_DEBUG_EXTRA DLOG(INFO) << "sending message @" << message << " on channel @" << this << " with type " << message->type() @@ -345,6 +354,11 @@ bool Channel::ChannelImpl::ProcessOutgoingMessages( // Write to pipe... Message* m = output_queue_.front(); + + // Oversized messages should be rejected in Send(). + DCHECK_LE(m->size(), kMaximumMessageSize) + << "Attempt to send oversized message"; + BOOL ok = WriteFile(pipe_, m->data(), m->size(), diff --git a/ipc/ipc_sync_channel.cc b/ipc/ipc_sync_channel.cc index 3aa7a26..5a100cf 100644 --- a/ipc/ipc_sync_channel.cc +++ b/ipc/ipc_sync_channel.cc @@ -382,6 +382,15 @@ bool SyncChannel::Send(Message* message) { } bool SyncChannel::SendWithTimeout(Message* message, int timeout_ms) { + if(message->size() > IPC::Channel::kMaximumMessageSize) { + LOG(ERROR) << "Attempt to send oversized message " + << message->size() + << " type=" + << message->type(); + delete message; + return false; + } + if (!message->is_sync()) { ChannelProxy::Send(message); return true; |