diff options
Diffstat (limited to 'base/clipboard.cc')
| -rw-r--r-- | base/clipboard.cc | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/base/clipboard.cc b/base/clipboard.cc index 8349b3d..e41fd93 100644 --- a/base/clipboard.cc +++ b/base/clipboard.cc @@ -6,6 +6,18 @@ #include "base/logging.h" +namespace { + +// A compromised renderer could send us bad data, so validate it. +bool IsBitmapSafe(const Clipboard::ObjectMapParams& params) { + const gfx::Size* size = + reinterpret_cast<const gfx::Size*>(&(params[1].front())); + return params[0].size() == + static_cast<size_t>(size->width() * size->height() * 4); +} + +} + void Clipboard::DispatchObject(ObjectType type, const ObjectMapParams& params) { switch (type) { case CBF_TEXT: @@ -40,6 +52,8 @@ void Clipboard::DispatchObject(ObjectType type, const ObjectMapParams& params) { #if defined(OS_WIN) || defined(OS_LINUX) case CBF_BITMAP: + if (!IsBitmapSafe(params)) + return; WriteBitmap(&(params[0].front()), &(params[1].front())); break; #endif // defined(OS_WIN) || defined(OS_LINUX) |