Bug 2025417: Capping a max size on SharedMap value that could be stored/broadcasted.r=ipc-reviewers,mccr8

Differential Revision: https://phabricator.services.mozilla.com/D301581

dom/ipc/SharedMap.cpp

@@ -7,6 +7,7 @@
 #include "MemMapSnapshot.h"
 #include "ScriptPreloader-inl.h"
 #include "SharedMapChangeEvent.h"
+#include "mozilla/CheckedInt.h"
 #include "mozilla/IOBuffers.h"
 #include "mozilla/RefPtr.h"
 #include "mozilla/ScriptPreloader.h"
@@ -157,9 +158,13 @@ bool SharedMap::GetValueAtIndex(JSContext* aCx, uint32_t aIndex,
 void SharedMap::Entry::SetData(StructuredCloneData* aHolder) {
   MOZ_ASSERT(!aHolder->SupportsTransferring());
 
+  CheckedInt<uint32_t> size = aHolder->BufferData().Size();
+  MOZ_RELEASE_ASSERT(size.isValid(),
+                     "SharedMap entry size exceeds max allowed size");
+
   mData = AsVariant(RefPtr{aHolder});
 
-  mSize = Holder()->BufferData().Size();
+  mSize = size.value();
   mBlobCount = Holder()->BlobImpls().Length();
 }
 
@@ -392,6 +397,12 @@ void WritableSharedMap::Set(JSContext* aCx, const nsACString& aName,
     return;
   }
 
+  // Cap the maximum size of a value that can be stored inside SharedMap.
+  if (!CheckedInt<uint32_t>(holder->BufferData().Size()).isValid()) {
+    aRv.ThrowRangeError("SharedMap value too large");
+    return;
+  }
+
   if (!holder->InputStreams().IsEmpty()) {
     aRv.Throw(NS_ERROR_INVALID_ARG);
     return;