Code: void ClipboardMessageFilter::OnWriteObjectsSync(
    const ui::Clipboard::ObjectMap& objects,
    base::SharedMemoryHandle bitmap_handle) {
  DCHECK(base::SharedMemory::IsHandleValid(bitmap_handle))
      << "Bad bitmap handle";

   scoped_ptr<ui::Clipboard::ObjectMap> long_living_objects(
       new ui::Clipboard::ObjectMap(objects));
  if (!ui::Clipboard::ReplaceSharedMemHandle(
           long_living_objects.get(), bitmap_handle, PeerHandle()))
    return;

  BrowserThread::PostTask(
      BrowserThread::UI,
      FROM_HERE,
      base::Bind(&WriteObjectsOnUIThread,
                 base::Owned(long_living_objects.release())));
}

Vulnerability Type: DoS 
CWE ID: CWE-20
Summary: The ScopedClipboardWriter::WritePickledData function in ui/base/clipboard/scoped_clipboard_writer.cc in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows does not verify a certain format value, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the clipboard.
Commit Message: Refactor ui::Clipboard::ObjectMap sanitization in ClipboardMsgFilter.

BUG=352395
R=tony@chromium.org
TBR=creis@chromium.org

Review URL: https://codereview.chromium.org/200523004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@257164 0039d316-1c4b-4281-b951-d872f2087c98