Allow data URL > 2MB for loadDataWithBaseURL

content/common/content_param_traits.cc

Index: content/common/content_param_traits.cc
diff --git a/content/common/content_param_traits.cc b/content/common/content_param_traits.cc
index 3b0ab98110621bd5780689e87fa5119ba34c2725..65a2a1fd99221082f44d5c083008621ec46b5976 100644
--- a/content/common/content_param_traits.cc
+++ b/content/common/content_param_traits.cc
@@ -11,6 +11,41 @@
 
 namespace IPC {
 
+void ParamTraits<scoped_refptr<base::RefCountedMemory> >::Write(
+    Message* m,
+    const param_type& p) {
+  const char* data = NULL;
+  size_t size = 0;
+  if (p.get()) {
+    data = reinterpret_cast<const char*>(p->front());
+    size = p->size();
+  }
+  m->WriteData(data, size);
+}
+
+bool ParamTraits<scoped_refptr<base::RefCountedMemory> >::Read(
+    const Message* m,
+    PickleIterator* iter,
+    param_type* p) {
+  const char* data;
+  int len;
+  if (!m->ReadData(iter, &data, &len))
+    return false;
+  if (len > 0) {
+    scoped_refptr<base::RefCountedString> res = new base::RefCountedString;
+    res->data().assign(data, len);

[jln (very slow on Chromium), 2013/12/02 23:05:25]

This clearly needs a reasonable limit on len.

This would allow an attacker to trivially spray the address space of another
process.

[joth, 2013/12/02 23:21:38]

Good point.

The required use-case is only for sending the data payload from browser ->
renderer. unfortunately by the time it gets to this layer, that direction
information is lost

Further, we only need this support for android webview, which runs in single
process mode so this level of memory protection between renderer and browser is
moot. Again, by the time we get down to this layer that point is also moot.

I'll have to have a think if there's a sensible way to reduce the scope of this
patch to the interesting scenarios then.

+    *p = res;
+  } else {
+    *p = NULL;
+  }
+  return true;
+}
+
+void ParamTraits<scoped_refptr<base::RefCountedMemory> >::Log(
+    const param_type& p, std::string* l) {
+  l->append("(RefCountedMemory)");
+}
+
 void ParamTraits<net::IPEndPoint>::Write(Message* m, const param_type& p) {
   WriteParam(m, p.address());
   WriteParam(m, p.port());