/* Provenance: Chromium FileReaderLoader::ArrayBufferResult after CVE-2019-5786. * repo: chromium/chromium * commit: ba9748e78ec7e9c0d594e7edf7b2c07ea2a90449 * parent: 9f3fccdba567f30ea39b08f57d8d5b49cd832b4a * commit_url: https://github.com/chromium/chromium/commit/ba9748e78ec7e9c0d594e7edf7b2c07ea2a90449 * cve: CVE-2019-5786 * license: BSD-3-Clause * function: FileReaderLoader::ArrayBufferResult * relpath: third_party/blink/renderer/core/fileapi/file_reader_loader.cc */ #include #include enum class FileErrorCode { kOK }; class ArrayBuffer { public: static void *Create(const void *data, size_t length) { (void)data; (void)length; return nullptr; } }; class DOMArrayBuffer { public: static DOMArrayBuffer *Create(void *buffer) { (void)buffer; return nullptr; } }; struct RawData { void *ToArrayBuffer() { return nullptr; } size_t ByteLength() const { return 0; } const void *Data() const { return nullptr; } }; class FileReaderLoader { public: DOMArrayBuffer *ArrayBufferResult(); DOMArrayBuffer *array_buffer_result_ = nullptr; std::unique_ptr raw_data_; FileErrorCode error_code_ = FileErrorCode::kOK; bool finished_loading_ = false; void AdjustReportedMemoryUsageToV8(int64_t delta) { (void)delta; } }; DOMArrayBuffer *FileReaderLoader::ArrayBufferResult() { if (array_buffer_result_) return array_buffer_result_; // If the loading is not started or an error occurs, return an empty result. if (!raw_data_ || error_code_ != FileErrorCode::kOK) return nullptr; if (!finished_loading_) { return DOMArrayBuffer::Create(ArrayBuffer::Create(raw_data_->Data(), raw_data_->ByteLength())); } array_buffer_result_ = DOMArrayBuffer::Create(raw_data_->ToArrayBuffer()); AdjustReportedMemoryUsageToV8(-1 * static_cast(raw_data_->ByteLength())); raw_data_.reset(); return array_buffer_result_; }