5 files changed, 21 insertions, 0 deletions
diff --git a/base/debug/debugger_posix.cc b/base/debug/debugger_posix.cc
index a5ab066..2df3c4c 100644
--- a/base/debug/debugger_posix.cc
+++ b/base/debug/debugger_posix.cc
@@ -159,6 +159,9 @@ bool DebugUtil::BeingDebugged() {
 
 void BreakDebugger() {
   DEBUG_BREAK();
+#if defined(NDEBUG)
+  _exit(1);
+#endif
 }
 
 }  // namespace debug
diff --git a/base/debug/debugger_win.cc b/base/debug/debugger_win.cc
index d1d47cd..51a067e 100644
--- a/base/debug/debugger_win.cc
+++ b/base/debug/debugger_win.cc
@@ -106,6 +106,9 @@ void BreakDebugger() {
   if (DebugUtil::AreDialogsSuppressed())
     _exit(1);
   __debugbreak();
+#if defined(NDEBUG)
+  _exit(1);
+#endif
 }
 
 }  // namespace debug
diff --git a/base/pickle.cc b/base/pickle.cc
index 3f376e3..7745527 100644
--- a/base/pickle.cc
+++ b/base/pickle.cc
@@ -406,6 +406,9 @@ const char* Pickle::FindNext(size_t header_size,
   DCHECK(header_size == AlignInt(header_size, sizeof(uint32)));
   DCHECK(header_size <= static_cast<size_t>(kPayloadUnit));
 
+  if (static_cast<size_t>(end - start) < sizeof(Header))
+    return NULL;
+
   const Header* hdr = reinterpret_cast<const Header*>(start);
   const char* payload_base = start + header_size;
   const char* payload_end = payload_base + hdr->payload_size;
diff --git a/base/pickle.h b/base/pickle.h
index 6006e62..03f0af1 100644
--- a/base/pickle.h
+++ b/base/pickle.h
@@ -236,6 +236,7 @@ class Pickle {
 
   FRIEND_TEST_ALL_PREFIXES(PickleTest, Resize);
   FRIEND_TEST_ALL_PREFIXES(PickleTest, FindNext);
+  FRIEND_TEST_ALL_PREFIXES(PickleTest, FindNextWithIncompleteHeader);
   FRIEND_TEST_ALL_PREFIXES(PickleTest, IteratorHasRoom);
 };
 
diff --git a/base/pickle_unittest.cc b/base/pickle_unittest.cc
index fdc0664..39eaa1b 100644
--- a/base/pickle_unittest.cc
+++ b/base/pickle_unittest.cc
@@ -171,6 +171,17 @@ TEST(PickleTest, FindNext) {
   EXPECT_TRUE(end == Pickle::FindNext(pickle.header_size_, start, end + 1));
 }
 
+TEST(PickleTest, FindNextWithIncompleteHeader) {
+  size_t header_size = sizeof(Pickle::Header);
+  scoped_array<char> buffer(new char[header_size - 1]);
+  memset(buffer.get(), 0x1, header_size - 1);
+
+  const char* start = buffer.get();
+  const char* end = start + header_size - 1;
+
+  EXPECT_TRUE(NULL == Pickle::FindNext(header_size, start, end));
+}
+
 TEST(PickleTest, IteratorHasRoom) {
   Pickle pickle;
   EXPECT_TRUE(pickle.WriteInt(1));