tree 621f1d4c9b115f3a6494892dae570d4bc9b96376
parent a462a3b621d25b2b9475b1b80b4bfc0f13f9a899
author Will Harris <wfh@chromium.org> 1507524934 +0000
committer Commit Bot <commit-bot@chromium.org> 1507524934 +0000

Fix out-of-bounds read in sandbox broker.

It is unsafe to call GetActualBufferSize if the param count declared
by the buffer makes the min_declared_size larger than the buffer size.

BUG=772621

Cq-Include-Trybots: master.tryserver.chromium.win:win10_chromium_x64_rel_ng
Change-Id: I9d3930230442a055ac27aeafdff52d8b553ec214
Reviewed-on: https://chromium-review.googlesource.com/701283
Reviewed-by: Justin Schuh <jschuh@chromium.org>
Commit-Queue: Justin Schuh <jschuh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#507329}