Commit message: None
CVE: CVE-2013-0892
Vulnerability description: Multiple unspecified vulnerabilities in the IPC layer in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allow remote attackers to cause a denial of service or possibly have other impact via unknown vectors.

Project: Chrome

bool CheckMenu(int depth, const PP_Flash_Menu* menu) {
  if (depth > kMaxMenuDepth || !menu)
    return false;
  ++depth;

  if (menu->count && !menu->items)
    return false;

  for (uint32_t i = 0; i < menu->count; ++i) {
    if (!CheckMenuItem(depth, menu->items + i))
      return false;
  }
  return true;
}

Project: Chrome

bool CheckMenuItem(int depth, const PP_Flash_MenuItem* item) {
  if (item->type == PP_FLASH_MENUITEM_TYPE_SUBMENU)
    return CheckMenu(depth, item->submenu);
  return true;
}

Project: Chrome

void FreeMenu(const PP_Flash_Menu* menu) {
  if (menu->items) {
    for (uint32_t i = 0; i < menu->count; ++i)
      FreeMenuItem(menu->items + i);
    delete [] menu->items;
  }
  delete menu;
}

Project: Chrome

void FreeMenuItem(const PP_Flash_MenuItem* menu_item) {
  if (menu_item->name)
    delete [] menu_item->name;
  if (menu_item->submenu)
    FreeMenu(menu_item->submenu);
}

Project: Chrome

bool SerializedFlashMenu::ReadFromMessage(const IPC::Message* m,
                                          PickleIterator* iter) {
  DCHECK(!pp_menu_);
  pp_menu_ = ReadMenu(0, m, iter);
  if (!pp_menu_)
    return false;

  own_menu_ = true;
  return true;
}

Project: Chrome

bool ReadMenuItem(int depth,
                  const IPC::Message* m,
                  PickleIterator* iter,
                  PP_Flash_MenuItem* menu_item) {
  uint32_t type;
  if (!m->ReadUInt32(iter, &type))
    return false;
  if (type > PP_FLASH_MENUITEM_TYPE_SUBMENU)
    return false;
  menu_item->type = static_cast<PP_Flash_MenuItem_Type>(type);
  std::string name;
  if (!m->ReadString(iter, &name))
    return false;
  menu_item->name = new char[name.size() + 1];
  std::copy(name.begin(), name.end(), menu_item->name);
  menu_item->name[name.size()] = 0;
  if (!m->ReadInt(iter, &menu_item->id))
    return false;
  if (!IPC::ParamTraits<PP_Bool>::Read(m, iter, &menu_item->enabled))
    return false;
  if (!IPC::ParamTraits<PP_Bool>::Read(m, iter, &menu_item->checked))
    return false;
  if (type == PP_FLASH_MENUITEM_TYPE_SUBMENU) {
    menu_item->submenu = ReadMenu(depth, m, iter);
    if (!menu_item->submenu)
      return false;
  }
  return true;
}

Project: Chrome

SerializedFlashMenu::SerializedFlashMenu()
    : pp_menu_(NULL),
      own_menu_(false) {
}

Project: Chrome

bool SerializedFlashMenu::SetPPMenu(const PP_Flash_Menu* menu) {
  DCHECK(!pp_menu_);
  if (!CheckMenu(0, menu))
    return false;
  pp_menu_ = menu;
  own_menu_ = false;
  return true;
}

Project: Chrome

void WriteMenu(IPC::Message* m, const PP_Flash_Menu* menu) {
  m->WriteUInt32(menu->count);
  for (uint32_t i = 0; i < menu->count; ++i)
    WriteMenuItem(m, menu->items + i);
}

Project: Chrome

void SerializedFlashMenu::WriteToMessage(IPC::Message* m) const {
  WriteMenu(m, pp_menu_);
}

Project: Chrome

SerializedFlashMenu::~SerializedFlashMenu() {
  if (own_menu_)
    FreeMenu(pp_menu_);
}