From 23ba60b3b6e4e6cfa36684ddf621a6afcc6906e4 Mon Sep 17 00:00:00 2001 From: eroman Date: Tue, 26 May 2015 17:09:39 -0700 Subject: Add constructors for IOBuffer that take the buffer length as a size_t. Once the consumers have all been updated to work with unsigned buffer lengths, I will remove the signed int versions. For now this change adds some runtime safety checks, and facilitates the ongoing conversion to size_t. A minority of consumers were calling IOBuffer with something other than "int" or "size_t", and those were updated by this change. BUG=488553,491315 TBR=michaeln@chromium.org,pfeldman@chromium.org,bradnelson@chromium.org, rockot@chromium.org, dimich@chromium.org Review URL: https://codereview.chromium.org/1147333003 Cr-Commit-Position: refs/heads/master@{#331485} --- device/hid/hid_connection_mac.cc | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'device/hid') diff --git a/device/hid/hid_connection_mac.cc b/device/hid/hid_connection_mac.cc index de93cc6..57f56af 100644 --- a/device/hid/hid_connection_mac.cc +++ b/device/hid/hid_connection_mac.cc @@ -7,6 +7,7 @@ #include "base/bind.h" #include "base/location.h" #include "base/mac/foundation_util.h" +#include "base/numerics/safe_math.h" #include "base/single_thread_task_runner.h" #include "base/strings/stringprintf.h" #include "base/thread_task_runner_handle.h" @@ -135,10 +136,12 @@ void HidConnectionMac::InputReportCallback(void* context, scoped_refptr buffer; if (connection->device_info()->has_report_id()) { // report_id is already contained in report_bytes - buffer = new net::IOBufferWithSize(report_length); + buffer = new net::IOBufferWithSize( + base::CheckedNumeric(report_length).ValueOrDie()); memcpy(buffer->data(), report_bytes, report_length); } else { - buffer = new net::IOBufferWithSize(report_length + 1); + buffer = new net::IOBufferWithSize( + (base::CheckedNumeric(report_length) + 1).ValueOrDie()); buffer->data()[0] = 0; memcpy(buffer->data() + 1, report_bytes, report_length); } -- cgit v1.1