Reland: Prevent unsafe narrowing: base/
This relands https://chromium-review.googlesource.com/c/chromium/src/+/3717404 . Bug: 1292951 Change-Id: I79a1d884d297903886cf3d8819f8962ba250ccb9 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3727447 Commit-Queue: Peter Kasting <pkasting@chromium.org> Auto-Submit: Peter Kasting <pkasting@chromium.org> Reviewed-by: danakj <danakj@chromium.org> Owners-Override: danakj <danakj@chromium.org> Cr-Commit-Position: refs/heads/main@{#1018684}
This commit is contained in:

committed by
Chromium LUCI CQ

parent
c8f60d0ffd
commit
28b51cf40e
android_webview/browser
base
debug
guid.cclogging.ccmemory
metrics
pickle.ccpickle.hpickle_fuzzer.ccpickle_unittest.ccpower_monitor
rand_util.ccsampling_heap_profiler
substring_set_matcher
sync_socket_win.ccsystem
token.cctrace_event
chrome/browser/tab
components/nacl/loader
content
browser
renderer_host
common
public
common
renderer
extensions/renderer
ipc
net/cert
ppapi/proxy
services/network/public/cpp
skia/ext
storage/browser/file_system
third_party/blink/common
ui
@@ -43,16 +43,15 @@ bool ReadVectorWithoutCopy(const base::Pickle* m,
|
||||
base::PickleIterator* iter,
|
||||
std::vector<T>* output) {
|
||||
// This part is just a copy of the the default ParamTraits vector Read().
|
||||
int size;
|
||||
// ReadLength() checks for < 0 itself.
|
||||
size_t size;
|
||||
if (!iter->ReadLength(&size))
|
||||
return false;
|
||||
// Resizing beforehand is not safe, see BUG 1006367 for details.
|
||||
if (INT_MAX / sizeof(T) <= static_cast<size_t>(size))
|
||||
if (size > INT_MAX / sizeof(T))
|
||||
return false;
|
||||
|
||||
output->reserve(size);
|
||||
for (int i = 0; i < size; i++) {
|
||||
for (size_t i = 0; i < size; i++) {
|
||||
T cur;
|
||||
if (!ReadParam(m, iter, &cur))
|
||||
return false;
|
||||
@@ -105,7 +104,7 @@ void ParamTraits<PP_Bool>::Log(const param_type& p, std::string* l) {
|
||||
void ParamTraits<PP_NetAddress_Private>::Write(base::Pickle* m,
|
||||
const param_type& p) {
|
||||
WriteParam(m, p.size);
|
||||
m->WriteBytes(p.data, static_cast<int>(p.size));
|
||||
m->WriteBytes(p.data, p.size);
|
||||
}
|
||||
|
||||
// static
|
||||
|
@@ -238,7 +238,7 @@ void URLLoaderResource::OnPluginMsgSendData(
|
||||
const IPC::Message& message) {
|
||||
base::PickleIterator iter(message);
|
||||
const char* data;
|
||||
int data_length;
|
||||
size_t data_length;
|
||||
if (!iter.ReadData(&data, &data_length)) {
|
||||
NOTREACHED() << "Expecting data";
|
||||
return;
|
||||
|
Reference in New Issue
Block a user