Fix PickleIterator::GetReadPointerAndAdvance() not to produce wild addresses

base/pickle.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/pickle.h"
 
 #include <stdlib.h>
 
 #include <algorithm>  // for max()
 
@@ skipping 27 matching lines @@
   if (read_ptr_ + sizeof(Type) > read_end_ptr_)
     return NULL;
   if (sizeof(Type) < sizeof(uint32))
     read_ptr_ += AlignInt(sizeof(Type), sizeof(uint32));
   else
     read_ptr_ += sizeof(Type);
   return current_read_ptr;
 }
 
 const char* PickleIterator::GetReadPointerAndAdvance(int num_bytes) {
+  if (num_bytes < 0 || read_end_ptr_ - read_ptr_ < num_bytes)

[jbates, 2012/03/13 16:52:44]

Much cleaner!

+    return NULL;
   const char* current_read_ptr = read_ptr_;
-  const char* end_data_ptr = read_ptr_ + num_bytes;
-  if (num_bytes < 0)
-    return NULL;
-  // Check for enough space and for wrapping.
-  if (end_data_ptr > read_end_ptr_ || end_data_ptr < current_read_ptr)
-    return NULL;
   read_ptr_ += AlignInt(num_bytes, sizeof(uint32));
   return current_read_ptr;
 }
 
 inline const char* PickleIterator::GetReadPointerAndAdvance(int num_elements,
                                                           size_t size_element) {
   // Check for int32 overflow.
   int64 num_bytes = static_cast<int64>(num_elements) * size_element;
   int num_bytes32 = static_cast<int>(num_bytes);
   if (num_bytes != static_cast<int64>(num_bytes32))
@@ skipping 291 matching lines @@
     return NULL;
 
   const Header* hdr = reinterpret_cast<const Header*>(start);
   const char* payload_base = start + header_size;
   const char* payload_end = payload_base + hdr->payload_size;
   if (payload_end < payload_base)
     return NULL;
 
   return (payload_end > end) ? NULL : payload_end;
 }