Commit f3a9de14 authored by Tom Ritter's avatar Tom Ritter Committed by Georg Koppen
Browse files

Bug 1461421 Use OffsetOf to calculate the location of param_info_ rather than... 

Bug 1461421 Use OffsetOf to calculate the location of param_info_ rather than assuming it's at the end of the parent class r?bobowen

MozReview-Commit-ID: D7REZiAIMpN
parent 8c8c41b3

security/sandbox/chromium/sandbox/win/src/crosscall_params.h

+5 −0
Original line number Diff line number Diff line
@@ -60,6 +60,7 @@ union MultiType { 
//  - Add another Callback typedef to Dispatcher.

//  - Add another case to the switch on SharedMemIPCServer::InvokeCallback.

//  - Add another case to the switch in GetActualAndMaxBufferSize

//  - Add another case to the switch in GetOffsetOfFirstMemberOfActualCallParams

const int kMaxIpcParams = 9;



// Contains the information about a parameter in the ipc buffer.
@@ -92,6 +93,8 @@ struct CrossCallReturn { 
  MultiType extended[kExtendedReturnCount];

};



uint32_t GetOffsetOfFirstMemberOfActualCallParams(uint32_t param_count);



// CrossCallParams base class that models the input params all packed in a

// single compact memory blob. The representation can vary but in general a

// given child of this class is meant to represent all input parameters
@@ -276,6 +279,8 @@ class ActualCallParams : public CrossCallParams { 
  char parameters_[BLOCK_SIZE - sizeof(CrossCallParams)

                   - sizeof(ParamInfo) * (NUMBER_PARAMS + 1)];

  DISALLOW_COPY_AND_ASSIGN(ActualCallParams);



  friend uint32_t GetOffsetOfFirstMemberOfActualCallParams(uint32_t param_count);

};



static_assert(sizeof(ActualCallParams<1, 1024>) == 1024, "bad size buffer");

security/sandbox/chromium/sandbox/win/src/crosscall_server.cc

+43 −13
Original line number Diff line number Diff line
@@ -27,10 +27,8 @@ const size_t kMaxBufferSize = sandbox::kIPCChannelSize; 


namespace sandbox {



// Returns the actual size for the parameters in an IPC buffer. Returns

// zero if the |param_count| is zero or too big.

uint32_t GetActualBufferSize(uint32_t param_count, void* buffer_base) {

// The template types are used to calculate the maximum expected size.

typedef ActualCallParams<0, kMaxBufferSize> ActualCP0;

typedef ActualCallParams<1, kMaxBufferSize> ActualCP1;

typedef ActualCallParams<2, kMaxBufferSize> ActualCP2;

typedef ActualCallParams<3, kMaxBufferSize> ActualCP3;
@@ -41,6 +39,9 @@ uint32_t GetActualBufferSize(uint32_t param_count, void* buffer_base) { 
typedef ActualCallParams<8, kMaxBufferSize> ActualCP8;

typedef ActualCallParams<9, kMaxBufferSize> ActualCP9;



// Returns the actual size for the parameters in an IPC buffer. Returns

// zero if the |param_count| is zero or too big.

uint32_t GetActualBufferSize(uint32_t param_count, void* buffer_base) {

  // Retrieve the actual size and the maximum size of the params buffer.

  switch (param_count) {

    case 0:
@@ -68,6 +69,35 @@ uint32_t GetActualBufferSize(uint32_t param_count, void* buffer_base) { 
  }

}



// Returns the actual size for the parameters in an IPC buffer. Returns

// zero if the |param_count| is zero or too big.

uint32_t GetOffsetOfFirstMemberOfActualCallParams(uint32_t param_count) {

  switch (param_count) {

    case 0:

      return offsetof(ActualCP0, param_info_);

    case 1:

      return offsetof(ActualCP1, param_info_);

    case 2:

      return offsetof(ActualCP2, param_info_);

    case 3:

      return offsetof(ActualCP3, param_info_);

    case 4:

      return offsetof(ActualCP4, param_info_);

    case 5:

      return offsetof(ActualCP5, param_info_);

    case 6:

      return offsetof(ActualCP6, param_info_);

    case 7:

      return offsetof(ActualCP7, param_info_);

    case 8:

      return offsetof(ActualCP8, param_info_);

    case 9:

      return offsetof(ActualCP9, param_info_);

    default:

      return 0;

  }

}



// Verifies that the declared sizes of an IPC buffer are within range.

bool IsSizeWithinRange(uint32_t buffer_size,

                       uint32_t min_declared_size,
@@ -137,7 +167,7 @@ CrossCallParamsEx* CrossCallParamsEx::CreateFromBuffer(void* buffer_base, 
    // Check against the minimum size given the number of stated params

    // if too small we bail out.

    param_count = call_params->GetParamsCount();

    min_declared_size = sizeof(CrossCallParams) +

    min_declared_size = GetOffsetOfFirstMemberOfActualCallParams(param_count) +

                        ((param_count + 1) * sizeof(ParamInfo));



    // Retrieve the declared size which if it fails returns 0.
@@ -157,7 +187,7 @@ CrossCallParamsEx* CrossCallParamsEx::CreateFromBuffer(void* buffer_base, 
    // should be actually read.

    _ReadWriteBarrier();



    min_declared_size = sizeof(CrossCallParams) +

    min_declared_size = GetOffsetOfFirstMemberOfActualCallParams(param_count) +

                        ((param_count + 1) * sizeof(ParamInfo));



    // Check that the copied buffer is still valid.