1 files changed, 43 insertions, 3 deletions

diff --git a/chromium/net/base/io_buffer.cc b/chromium/net/base/io_buffer.cc
index a375381bfd9..d722b449148 100644
--- a/chromium/net/base/io_buffer.cc
+++ b/chromium/net/base/io_buffer.cc
@@ -5,15 +5,38 @@
 #include "net/base/io_buffer.h"
 
 #include "base/logging.h"
+#include "base/numerics/safe_math.h"
 
 namespace net {
 
+namespace {
+
+// TODO(eroman): IOBuffer is being converted to require buffer sizes and offsets
+// be specified as "size_t" rather than "int" (crbug.com/488553). To facilitate
+// this move (since LOTS of code needs to be updated), both "size_t" and "int
+// are being accepted. When using "size_t" this function ensures that it can be
+// safely converted to an "int" without truncation.
+void AssertValidBufferSize(size_t size) {
+  base::CheckedNumeric<int>(size).ValueOrDie();
+}
+
+void AssertValidBufferSize(int size) {
+  CHECK_GE(size, 0);
+}
+
+}  // namespace
+
 IOBuffer::IOBuffer()
     : data_(NULL) {
 }
 
 IOBuffer::IOBuffer(int buffer_size) {
-  CHECK_GE(buffer_size, 0);
+  AssertValidBufferSize(buffer_size);
+  data_ = new char[buffer_size];
+}
+
+IOBuffer::IOBuffer(size_t buffer_size) {
+  AssertValidBufferSize(buffer_size);
   data_ = new char[buffer_size];
 }
 
@@ -29,11 +52,22 @@ IOBuffer::~IOBuffer() {
 IOBufferWithSize::IOBufferWithSize(int size)
     : IOBuffer(size),
       size_(size) {
+  AssertValidBufferSize(size);
+}
+
+IOBufferWithSize::IOBufferWithSize(size_t size) : IOBuffer(size), size_(size) {
+  // Note: Size check is done in superclass' constructor.
 }
 
 IOBufferWithSize::IOBufferWithSize(char* data, int size)
     : IOBuffer(data),
       size_(size) {
+  AssertValidBufferSize(size);
+}
+
+IOBufferWithSize::IOBufferWithSize(char* data, size_t size)
+    : IOBuffer(data), size_(size) {
+  AssertValidBufferSize(size);
 }
 
 IOBufferWithSize::~IOBufferWithSize() {
@@ -42,13 +76,13 @@ IOBufferWithSize::~IOBufferWithSize() {
 StringIOBuffer::StringIOBuffer(const std::string& s)
     : IOBuffer(static_cast<char*>(NULL)),
       string_data_(s) {
-  CHECK_LT(s.size(), static_cast<size_t>(INT_MAX));
+  AssertValidBufferSize(s.size());
   data_ = const_cast<char*>(string_data_.data());
 }
 
 StringIOBuffer::StringIOBuffer(scoped_ptr<std::string> s)
     : IOBuffer(static_cast<char*>(NULL)) {
-  CHECK_LT(s->size(), static_cast<size_t>(INT_MAX));
+  AssertValidBufferSize(s->size());
   string_data_.swap(*s.get());
   data_ = const_cast<char*>(string_data_.data());
 }
@@ -64,6 +98,12 @@ DrainableIOBuffer::DrainableIOBuffer(IOBuffer* base, int size)
       base_(base),
       size_(size),
       used_(0) {
+  AssertValidBufferSize(size);
+}
+
+DrainableIOBuffer::DrainableIOBuffer(IOBuffer* base, size_t size)
+    : IOBuffer(base->data()), base_(base), size_(size), used_(0) {
+  AssertValidBufferSize(size);
 }
 
 void DrainableIOBuffer::DidConsume(int bytes) {