Integer overflow

Integer overflow in the CrossCallParamsEx::CreateFromBuffer function in sandbox/src/crosscallserver.cc in Google Chrome before 4.0.249.89 allows attackers to leverage renderer access to cause a denial of service heap memory corruption or possibly have unspecified other impact via a malformed...