Alex Gaynor 3e8fd2dc07 Bug 1450232 - in IPC, check that lengths fit in the available data before allocating data; r=mccr8
There are three things we want to be true:

a) If the child sends a large value and the parent can't allocate enough space
   for it we use an infallible allocation so the parent dies with an OOM.
b) If a fuzzer generates (huge-length, small-data) we don't try to allocate
   huge-length bytes; knowing that the read will fail.
c) No fuzzer-specific branches in the core IPC serialization code.

Finally, this makes (huge-length, small-data) consistent with other cases where
the data is potentially truncated: ReadParam returns false.

MozReview-Commit-ID: 6nDKrw5z4pt

--HG--
extra : rebase_source : 58372d29139e9545a6ed2852c7243affeab6fdb7
2018-04-19 16:53:29 -04:00
..