Code: PP_Flash_Menu* ReadMenu(int depth,
                        const IPC::Message* m,
                        PickleIterator* iter) {
  if (depth > kMaxMenuDepth)
    return NULL;
  ++depth;

  PP_Flash_Menu* menu = new PP_Flash_Menu;
  menu->items = NULL;

  if (!m->ReadUInt32(iter, &menu->count)) {
    FreeMenu(menu);
    return NULL;
  }

   if (menu->count == 0)
     return menu;
 
   menu->items = new PP_Flash_MenuItem[menu->count];
   memset(menu->items, 0, sizeof(PP_Flash_MenuItem) * menu->count);
   for (uint32_t i = 0; i < menu->count; ++i) {
    if (!ReadMenuItem(depth, m, iter, menu->items + i)) {
      FreeMenu(menu);
      return NULL;
    }
  }
  return menu;
}

Vulnerability Type: DoS 
CWE ID: 
Summary: Multiple unspecified vulnerabilities in the IPC layer in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allow remote attackers to cause a denial of service or possibly have other impact via unknown vectors.
Commit Message: IPC: defend against excessive number of submenu entries in PPAPI message.

BUG=168710
Review URL: https://codereview.chromium.org/11794037

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@175576 0039d316-1c4b-4281-b951-d872f2087c98