DevTools: validate IO.Read max read length param

Bug: 1032230
Change-Id: I6d024f2027a11d20ab667dd9a95ffe256181c906
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1960067Reviewed-by: Peter Kvitek <kvitekp@chromium.org>
Commit-Queue: Andrey Kosyakov <caseq@chromium.org>
Cr-Commit-Position: refs/heads/master@{#723584}

content/browser/devtools/protocol/io_handler.cc

@@ -77,7 +77,12 @@ void IOHandler::Read(
                                 "does not support random access"));
     return;
   }
-  stream->Read(offset.fromMaybe(-1), max_size.fromMaybe(kDefaultChunkSize),
+  int size = max_size.fromMaybe(kDefaultChunkSize);
+  if (size <= 0) {
+    callback->sendFailure(Response::InvalidParams("Invalid max read size"));
+    return;
+  }
+  stream->Read(offset.fromMaybe(-1), size,
                base::BindOnce(&IOHandler::ReadComplete,
                               weak_factory_.GetWeakPtr(), std::move(callback)));
 }

third_party/blink/web_tests/inspector-protocol/io/blob-streams-expected.txt

@@ -4,6 +4,10 @@ Next 5 bytes: "78901" eof: false, encoded: false
 Next chunk: 23456..56789 (999968)
 Seeking to 999996: "6789" eof: true, encoded: false
 Seeking to 0: "0123456789" eof: false, encoded: false
+Reading negative size, got error: {
+    code : -32602
+    message : Invalid max read size
+}
 From concurrent requests: 0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
 Total read: 1000000
 Error from close: undefined

third_party/blink/web_tests/inspector-protocol/io/blob-streams.js

@@ -20,6 +20,10 @@
   }
 
   function dumpResponse(title, response) {
+    if (response.error) {
+      testRunner.log(response.error, `${title}, got error: `);
+      return;
+    }
     testRunner.log(`${title}: "${response.result.data}" eof: ${response.result.eof}, encoded: ${response.result.base64Encoded}`);
   }
 
@@ -42,6 +46,9 @@
   response = await session.protocol.IO.read({handle: handle, offset: 0, size: 10});
   dumpResponse('Seeking to 0', response);
 
+  response = await session.protocol.IO.read({handle: handle, offset: 0, size: -1});
+  dumpResponse('Reading negative size', response);
+
   // Try multiple queued request
   var promises = [];
   for (var i = 0; i < 10; ++i)