Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-23 21:01:08 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1236358 - Improper reading of string16 in Pickle::ReadString16. r=jld

Browse Source 
--HG--
extra : rebase_source : 9f903d0f24e7132ab64c31ef133c2b76d1c3e5fd
This commit is contained in:
Haik Aftandilian 2016-03-10 07:49:41 -08:00
parent e527e48266
commit 4c360be8c3
2 changed files with 3 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
ipc/chromium/src/base/pickle.cc
View File

@ -437,6 +437,9 @@ bool Pickle::ReadWString(void** iter, std::wstring* result) const {
int len;
if (!ReadLength(iter, &len))
return false;
// Avoid integer multiplication overflow.
if (len > INT_MAX / static_cast<int>(sizeof(wchar_t)))
return false;
if (!IteratorHasRoomFor(*iter, len * sizeof(wchar_t)))
return false;
@ -447,24 +450,6 @@ bool Pickle::ReadWString(void** iter, std::wstring* result) const {
return true;
}
bool Pickle::ReadString16(void** iter, string16* result) const {
DCHECK(iter);
if (!*iter)
*iter = const_cast<char*>(payload());
int len;
if (!ReadLength(iter, &len))
return false;
if (!IteratorHasRoomFor(*iter, len))
return false;
char16* chars = reinterpret_cast<char16*>(*iter);
result->assign(chars, len);
UpdateIter(iter, len * sizeof(char16));
return true;
}
bool Pickle::ReadBytes(void** iter, const char** data, int length,
uint32_t alignment) const {
DCHECK(iter);
@ -590,14 +575,6 @@ bool Pickle::WriteWString(const std::wstring& value) {
static_cast<int>(value.size() * sizeof(wchar_t)));
}
bool Pickle::WriteString16(const string16& value) {
if (!WriteInt(static_cast<int>(value.size())))
return false;
return WriteBytes(value.data(),
static_cast<int>(value.size()) * sizeof(char16));
}
bool Pickle::WriteData(const char* data, int length) {
return WriteInt(length) && WriteBytes(data, length);
}

2
ipc/chromium/src/base/pickle.h
View File

@ -86,7 +86,6 @@ class Pickle {
MOZ_WARN_UNUSED_RESULT bool ReadUnsignedChar(void** iter, unsigned char* result) const;
MOZ_WARN_UNUSED_RESULT bool ReadString(void** iter, std::string* result) const;
MOZ_WARN_UNUSED_RESULT bool ReadWString(void** iter, std::wstring* result) const;
MOZ_WARN_UNUSED_RESULT bool ReadString16(void** iter, string16* result) const;
MOZ_WARN_UNUSED_RESULT bool ReadData(void** iter, const char** data, int* length) const;
MOZ_WARN_UNUSED_RESULT bool ReadBytes(void** iter, const char** data, int length,
uint32_t alignment = sizeof(memberAlignmentType)) const;
@ -151,7 +150,6 @@ class Pickle {
}
bool WriteString(const std::string& value);
bool WriteWString(const std::wstring& value);
bool WriteString16(const string16& value);
bool WriteData(const char* data, int length);
bool WriteBytes(const void* data, int data_len,
uint32_t alignment = sizeof(memberAlignmentType));