Bug 1865046 - Check ProtocolId cast in IPC fuzzer. r=truber

Differential Revision: https://phabricator.services.mozilla.com/D193772
Brli · Nov 27, 2023 · 76269b7 · 76269b7
1 parent a4d0df0
commit 76269b7
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/tools/fuzzing/ipc/IPCFuzzController.cpp b/tools/fuzzing/ipc/IPCFuzzController.cpp
@@ -587,7 +587,12 @@ bool IPCFuzzController::MakeTargetDecision(
   } else if (isPreserveHeader) {
     // In preserveHeaderMode, we need to find an actor that matches the
     // requested message type instead of any random actor.
-    ProtocolId wantedProtocolId = static_cast<ProtocolId>(*type >> 16);
+    uint16_t maybeProtocolId = *type >> 16;
+    if (maybeProtocolId >= IPCMessageStart::LastMsgIndex) {
+      // Not a valid protocol.
+      return false;
+    }
+    ProtocolId wantedProtocolId = static_cast<ProtocolId>(maybeProtocolId);
     std::vector<uint32_t> allowedIndices;
     for (uint32_t i = 0; i < actors.size(); ++i) {
       if (actors[i].second == wantedProtocolId) {