Bug 1236358 - Improper reading of string16 in Pickle::ReadString16. r=jld

--HG--
extra : rebase_source : 9f903d0f24e7132ab64c31ef133c2b76d1c3e5fd

ipc/chromium/src/base/pickle.cc

@@ -437,6 +437,9 @@ bool Pickle::ReadWString(void** iter, std::wstring* result) const {
   int len;
   if (!ReadLength(iter, &len))
     return false;
+  // Avoid integer multiplication overflow.
+  if (len > INT_MAX / static_cast<int>(sizeof(wchar_t)))
+    return false;
   if (!IteratorHasRoomFor(*iter, len * sizeof(wchar_t)))
     return false;
 
@@ -447,24 +450,6 @@ bool Pickle::ReadWString(void** iter, std::wstring* result) const {
   return true;
 }
 
-bool Pickle::ReadString16(void** iter, string16* result) const {
-  DCHECK(iter);
-  if (!*iter)
-    *iter = const_cast<char*>(payload());
-
-  int len;
-  if (!ReadLength(iter, &len))
-    return false;
-  if (!IteratorHasRoomFor(*iter, len))
-    return false;
-
-  char16* chars = reinterpret_cast<char16*>(*iter);
-  result->assign(chars, len);
-
-  UpdateIter(iter, len * sizeof(char16));
-  return true;
-}
-
 bool Pickle::ReadBytes(void** iter, const char** data, int length,
                        uint32_t alignment) const {
   DCHECK(iter);
@@ -590,14 +575,6 @@ bool Pickle::WriteWString(const std::wstring& value) {
                     static_cast<int>(value.size() * sizeof(wchar_t)));
 }
 
-bool Pickle::WriteString16(const string16& value) {
-  if (!WriteInt(static_cast<int>(value.size())))
-    return false;
-
-  return WriteBytes(value.data(),
-                    static_cast<int>(value.size()) * sizeof(char16));
-}
-
 bool Pickle::WriteData(const char* data, int length) {
   return WriteInt(length) && WriteBytes(data, length);
 }

ipc/chromium/src/base/pickle.h

@@ -86,7 +86,6 @@ class Pickle {
   MOZ_WARN_UNUSED_RESULT bool ReadUnsignedChar(void** iter, unsigned char* result) const;
   MOZ_WARN_UNUSED_RESULT bool ReadString(void** iter, std::string* result) const;
   MOZ_WARN_UNUSED_RESULT bool ReadWString(void** iter, std::wstring* result) const;
-  MOZ_WARN_UNUSED_RESULT bool ReadString16(void** iter, string16* result) const;
   MOZ_WARN_UNUSED_RESULT bool ReadData(void** iter, const char** data, int* length) const;
   MOZ_WARN_UNUSED_RESULT bool ReadBytes(void** iter, const char** data, int length,
 					uint32_t alignment = sizeof(memberAlignmentType)) const;
@@ -151,7 +150,6 @@ class Pickle {
   }
   bool WriteString(const std::string& value);
   bool WriteWString(const std::wstring& value);
-  bool WriteString16(const string16& value);
   bool WriteData(const char* data, int length);
   bool WriteBytes(const void* data, int data_len,
                   uint32_t alignment = sizeof(memberAlignmentType));