Commit message: None
CVE: CVE-2011-2345
CWE: CWE-119
Vulnerability description: The NPAPI implementation in Google Chrome before 12.0.742.112 does not properly handle strings, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

Project: Chrome

bool PPResultAndExceptionToNPResult::CheckExceptionForNoResult() {
  DCHECK(!checked_exception_);  // Don't call more than once.
  DCHECK(!np_result_);  // Can't have a result when doing this.

  checked_exception_ = true;

  if (has_exception()) {
    ThrowException();
    success_ = false;
    return false;
  }
  success_ = true;
  return true;
}

Project: Chrome

void PPResultAndExceptionToNPResult::IgnoreException() {
  checked_exception_ = true;
}

Project: Chrome

NPObjectAccessorWithIdentifier::NPObjectAccessorWithIdentifier(
    NPObject* object,
    NPIdentifier identifier,
    bool allow_integer_identifier)
    : object_(PluginObject::FromNPObject(object)),
      identifier_(PP_MakeUndefined()) {
  if (object_) {
    identifier_ = Var::NPIdentifierToPPVar(object_->instance()->module(),
                                           identifier);
    if (identifier_.type == PP_VARTYPE_INT32 && !allow_integer_identifier)
      identifier_.type = PP_VARTYPE_UNDEFINED;  // Mark it invalid.
  }
}

Project: Chrome

PPResultAndExceptionToNPResult::PPResultAndExceptionToNPResult(
    NPObject* object_var,
    NPVariant* np_result)
    : object_var_(object_var),
      np_result_(np_result),
      exception_(PP_MakeUndefined()),
      success_(false),
      checked_exception_(false) {
}

Project: Chrome

PPVarArrayFromNPVariantArray::PPVarArrayFromNPVariantArray(
    PluginInstance* instance,
    size_t size,
    const NPVariant* variants)
    : size_(size) {
  if (size_ > 0) {
    array_.reset(new PP_Var[size_]);
    for (size_t i = 0; i < size_; i++)
      array_[i] = Var::NPVariantToPPVar(instance, &variants[i]);
  }
}

Project: Chrome

PPVarFromNPObject::PPVarFromNPObject(PluginInstance* instance, NPObject* object)
    : var_(ObjectVar::NPObjectToPPVar(instance, object)) {
}

Project: Chrome

bool PPResultAndExceptionToNPResult::SetResult(PP_Var result) {
  DCHECK(!checked_exception_);  // Don't call more than once.
  DCHECK(np_result_);  // Should be expecting a result.

  checked_exception_ = true;

  if (has_exception()) {
    ThrowException();
    success_ = false;
  } else if (!PPVarToNPVariant(result, np_result_)) {
    WebBindings::setException(object_var_, kInvalidPluginValue);
    success_ = false;
  } else {
    success_ = true;
  }

  Var::PluginReleasePPVar(result);
  return success_;
}

Project: Chrome

void PPResultAndExceptionToNPResult::ThrowException() {
  scoped_refptr<StringVar> string(StringVar::FromPPVar(exception_));
  if (string) {
    WebBindings::setException(object_var_, string->value().c_str());
  }
}

Project: Chrome

NPObjectAccessorWithIdentifier::~NPObjectAccessorWithIdentifier() {
  Var::PluginReleasePPVar(identifier_);
}

Project: Chrome

PPResultAndExceptionToNPResult::~PPResultAndExceptionToNPResult() {
  DCHECK(checked_exception_);

  ObjectVar::PluginReleasePPVar(exception_);
}

Project: Chrome

PPVarArrayFromNPVariantArray::~PPVarArrayFromNPVariantArray() {
  for (size_t i = 0; i < size_; i++)
    Var::PluginReleasePPVar(array_[i]);
}