Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(11)

Unified Diff: mojo/public/java/bindings/src/org/chromium/mojo/bindings/Decoder.java

Issue 2429203003: Limit Mojo messages recursion depth in Java (Closed)
Patch Set: Rebase Created 4 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: mojo/public/java/bindings/src/org/chromium/mojo/bindings/Decoder.java
diff --git a/mojo/public/java/bindings/src/org/chromium/mojo/bindings/Decoder.java b/mojo/public/java/bindings/src/org/chromium/mojo/bindings/Decoder.java
index 755fb019aca0f621d1c767b6705dfb6d5dbe8280..6898f93e099826c1e50e814233b7406b49f2279a 100644
--- a/mojo/public/java/bindings/src/org/chromium/mojo/bindings/Decoder.java
+++ b/mojo/public/java/bindings/src/org/chromium/mojo/bindings/Decoder.java
@@ -34,6 +34,10 @@ public class Decoder {
* Minimal value of the start of the next memory to claim.
*/
private long mMinNextMemory = 0;
+ /**
+ * The current nesting level when decoding.
+ */
+ private long mStackDepth;
/**
* The maximal memory accessible.
@@ -46,11 +50,17 @@ public class Decoder {
private final long mNumberOfHandles;
/**
+ * The maximum nesting level when decoding.
+ */
+ private static final int MAX_RECURSION_DEPTH = 100;
+
+ /**
* Constructor.
*/
Validator(long maxMemory, int numberOfHandles) {
mMaxMemory = maxMemory;
mNumberOfHandles = numberOfHandles;
+ mStackDepth = 0;
}
public void claimHandle(int handle) {
@@ -79,6 +89,17 @@ public class Decoder {
}
mMinNextMemory = BindingsHelper.align(end);
}
+
+ public void increaseStackDepth() {
+ ++mStackDepth;
+ if (mStackDepth >= MAX_RECURSION_DEPTH) {
+ throw new DeserializationException("Recursion depth limit exceeded.");
+ }
+ }
+
+ public void decreaseStackDepth() {
+ --mStackDepth;
+ }
}
/**
@@ -744,4 +765,12 @@ public class Decoder {
throw new DeserializationException("Buffer is smaller than expected.");
}
}
+
+ public void increaseStackDepth() {
+ mValidator.increaseStackDepth();
+ }
+
+ public void decreaseStackDepth() {
+ mValidator.decreaseStackDepth();
+ }
}

Powered by Google App Engine
This is Rietveld 408576698