Commit message: None
CVE: CVE-2014-3156
CWE: CWE-119
Vulnerability description: Buffer overflow in the clipboard implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger unexpected bitmap data, related to content/renderer/renderer_clipboard_client.cc and content/renderer/webclipboard_impl.cc.

Project: Chrome

bool SystemClipboard::CanSmartReplace() {
  if (!IsValidBufferType(buffer_))
    return false;
  bool result = false;
  clipboard_->IsFormatAvailable(mojom::ClipboardFormat::kSmartPaste, buffer_,
                                &result);
  return result;
}

Project: Chrome

SystemClipboard& SystemClipboard::GetInstance() {
  DEFINE_STATIC_LOCAL(SystemClipboard, clipboard, ());
  return clipboard;
}

Project: Chrome

bool SystemClipboard::IsHTMLAvailable() {
  if (!IsValidBufferType(buffer_))
    return false;
  bool result = false;
  clipboard_->IsFormatAvailable(mojom::ClipboardFormat::kHtml, buffer_,
                                &result);
  return result;
}

Project: Chrome

bool SystemClipboard::IsSelectionMode() const {
  return buffer_ == mojom::ClipboardBuffer::kSelection;
}

Project: Chrome

bool SystemClipboard::IsValidBufferType(mojom::ClipboardBuffer buffer) {
  switch (buffer) {
    case mojom::ClipboardBuffer::kStandard:
      return true;
    case mojom::ClipboardBuffer::kSelection:
#if defined(USE_X11)
      return true;
#else
      return false;
#endif
  }
  return true;
}

Project: Chrome

String NonNullString(const String& string) {
  return string.IsNull() ? g_empty_string16_bit : string;
}

Project: Chrome

Vector<String> SystemClipboard::ReadAvailableTypes() {
  Vector<String> types;
  if (IsValidBufferType(buffer_)) {
    bool unused;
    clipboard_->ReadAvailableTypes(buffer_, &types, &unused);
  }
  return types;
}

Project: Chrome

String SystemClipboard::ReadCustomData(const String& type) {
  if (!IsValidBufferType(buffer_))
    return String();
  String data;
  clipboard_->ReadCustomData(buffer_, NonNullString(type), &data);
  return data;
}

Project: Chrome

String SystemClipboard::ReadHTML(KURL& url,
                                 unsigned& fragment_start,
                                 unsigned& fragment_end) {
  String html;
  if (IsValidBufferType(buffer_)) {
    clipboard_->ReadHtml(buffer_, &html, &url,
                         static_cast<uint32_t*>(&fragment_start),
                         static_cast<uint32_t*>(&fragment_end));
  }
  if (html.IsEmpty()) {
    url = KURL();
    fragment_start = 0;
    fragment_end = 0;
  }
  return html;
}

Project: Chrome

SkBitmap SystemClipboard::ReadImage(mojom::ClipboardBuffer buffer) {
  SkBitmap image;
  if (IsValidBufferType(buffer))
    clipboard_->ReadImage(buffer, &image);
  return image;
}

Project: Chrome

String SystemClipboard::ReadPlainText() {
  return ReadPlainText(buffer_);
}

Project: Chrome

String SystemClipboard::ReadPlainText(mojom::ClipboardBuffer buffer) {
  if (!IsValidBufferType(buffer))
    return String();
  String text;
  clipboard_->ReadText(buffer, &text);
  return text;
}

Project: Chrome

String SystemClipboard::ReadRTF() {
  if (!IsValidBufferType(buffer_))
    return String();
  String rtf;
  clipboard_->ReadRtf(buffer_, &rtf);
  return rtf;
}

Project: Chrome

uint64_t SystemClipboard::SequenceNumber() {
  if (!IsValidBufferType(buffer_))
    return 0;

  uint64_t result = 0;
  clipboard_->GetSequenceNumber(buffer_, &result);
  return result;
}

Project: Chrome

SystemClipboard::SystemClipboard() {
  Platform::Current()->GetInterfaceProvider()->GetInterface(
      mojo::MakeRequest(&clipboard_));
}

Project: Chrome

void SystemClipboard::WriteDataObject(DataObject* data_object) {

  HashMap<String, String> custom_data;
  WebDragData data = data_object->ToWebDragData();
  for (const WebDragData::Item& item : data.Items()) {
    if (item.storage_type == WebDragData::Item::kStorageTypeString) {
      if (item.string_type == blink::kMimeTypeTextPlain) {
        clipboard_->WriteText(mojom::ClipboardBuffer::kStandard,
                              NonNullString(item.string_data));
      } else if (item.string_type == blink::kMimeTypeTextHTML) {
        clipboard_->WriteHtml(mojom::ClipboardBuffer::kStandard,
                              NonNullString(item.string_data), KURL());
      } else if (item.string_type != blink::kMimeTypeDownloadURL) {
        custom_data.insert(item.string_type, NonNullString(item.string_data));
      }
    }
  }
  if (!custom_data.IsEmpty()) {
    clipboard_->WriteCustomData(mojom::ClipboardBuffer::kStandard,
                                std::move(custom_data));
  }
  clipboard_->CommitWrite(mojom::ClipboardBuffer::kStandard);
}

Project: Chrome

void SystemClipboard::WritePlainText(const String& plain_text,
                                     SmartReplaceOption) {
  String text = plain_text;
#if defined(OS_WIN)
  ReplaceNewlinesWithWindowsStyleNewlines(text);
#endif
  clipboard_->WriteText(mojom::ClipboardBuffer::kStandard, NonNullString(text));
  clipboard_->CommitWrite(mojom::ClipboardBuffer::kStandard);
}