Commit message: None
CVE: CVE-2015-1232
CWE: CWE-119
Vulnerability description: Array index error in the MidiManagerUsb::DispatchSendMidiData function in media/midi/midi_manager_usb.cc in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an out-of-bounds write operation, a different vulnerability than CVE-2015-1212.

Project: Chrome

void MidiManagerUsb::Initialize(
    base::Callback<void(MidiResult result)> callback) {
  initialize_callback_ = callback;
  device_factory_->EnumerateDevices(
      this,
      base::Bind(&MidiManagerUsb::OnEnumerateDevicesDone,
                 base::Unretained(this)));
}

Project: Chrome

MidiManagerUsb::MidiManagerUsb(scoped_ptr<UsbMidiDevice::Factory> factory)
    : device_factory_(factory.Pass()) {
}

Project: Chrome

void MidiManagerUsb::OnEnumerateDevicesDone(bool result,
                                            UsbMidiDevice::Devices* devices) {
  if (!result) {
    initialize_callback_.Run(MIDI_INITIALIZATION_ERROR);
    return;
  }
  devices->swap(devices_);
  for (size_t i = 0; i < devices_.size(); ++i) {
    UsbMidiDescriptorParser parser;
    std::vector<uint8> descriptor = devices_[i]->GetDescriptor();
    const uint8* data = descriptor.size() > 0 ? &descriptor[0] : NULL;
    std::vector<UsbMidiJack> jacks;
    bool parse_result = parser.Parse(devices_[i],
                                     data,
                                     descriptor.size(),
                                     &jacks);
    if (!parse_result) {
      initialize_callback_.Run(MIDI_INITIALIZATION_ERROR);
      return;
    }
    std::vector<UsbMidiJack> input_jacks;
    for (size_t j = 0; j < jacks.size(); ++j) {
      if (jacks[j].direction() == UsbMidiJack::DIRECTION_OUT) {
        output_streams_.push_back(new UsbMidiOutputStream(jacks[j]));
        MidiPortInfo port;
        port.id = base::StringPrintf("port-%ld-%ld",
                                     static_cast<long>(i),
                                     static_cast<long>(j));
        AddOutputPort(port);
      } else {
        DCHECK_EQ(jacks[j].direction(), UsbMidiJack::DIRECTION_IN);
        input_jacks.push_back(jacks[j]);
        MidiPortInfo port;
        port.id = base::StringPrintf("port-%ld-%ld",
                                     static_cast<long>(i),
                                     static_cast<long>(j));
        AddInputPort(port);
      }
    }
    input_stream_.reset(new UsbMidiInputStream(input_jacks, this));
  }
  initialize_callback_.Run(MIDI_OK);
}

Project: Chrome

void MidiManagerUsb::ReceiveUsbMidiData(UsbMidiDevice* device,
                                        int endpoint_number,
                                        const uint8* data,
                                        size_t size,
                                        base::TimeTicks time) {
  if (!input_stream_)
    return;
  input_stream_->OnReceivedData(device,
                                endpoint_number,
                                data,
                                size,
                                time);
}

Project: Chrome

void MidiManagerUsb::StartInitialization() {
  Initialize(
      base::Bind(&MidiManager::CompleteInitialization, base::Unretained(this)));
}

Project: Chrome

MidiManagerUsb::~MidiManagerUsb() {
}

Project: Chrome

  void AddLog(const std::string& message) { log_ += message; }

Project: Chrome

  void CallCompleteInitialization(MidiResult result) {
    CompleteInitialization(result);
    base::RunLoop run_loop;
    run_loop.RunUntilIdle();
  }

Project: Chrome

  explicit FakeMidiManagerClient(Logger* logger)
      : complete_start_session_(false),
        result_(MIDI_NOT_SUPPORTED),
        logger_(logger) {}

Project: Chrome

  explicit FakeUsbMidiDevice(Logger* logger) : logger_(logger) {}

Project: Chrome

  void Finalize() {
    manager_->EndSession(client_.get());
  }

Project: Chrome

  void Initialize() {
    client_.reset(new FakeMidiManagerClient(&logger_));
    manager_->StartSession(client_.get());
  }

Project: Chrome

  bool IsInitializationCallbackInvoked() {
    return client_->complete_start_session_;
  }

Project: Chrome

  Logger() {}

Project: Chrome

  MidiManagerUsbTest() : message_loop_(new base::MessageLoop) {
    scoped_ptr<TestUsbMidiDeviceFactory> factory(new TestUsbMidiDeviceFactory);
    factory_ = factory.get();
    manager_.reset(new MidiManagerUsbForTesting(factory.Pass()));
  }

Project: Chrome

  void RunCallbackUntilCallbackInvoked(
      bool result, UsbMidiDevice::Devices* devices) {
    factory_->callback_.Run(result, devices);
    while (!client_->complete_start_session_) {
      base::RunLoop run_loop;
      run_loop.RunUntilIdle();
    }
  }

Project: Chrome

  void SetDescriptor(const std::vector<uint8> descriptor) {
    descriptor_ = descriptor;
  }

Project: Chrome

  std::string TakeLog() {
    std::string result;
    result.swap(log_);
    return result;
  }

Project: Chrome

  TestUsbMidiDeviceFactory() {}

Project: Chrome

  ~Logger() {}