Improve IndexedDB IPC message sanitization

content/browser/in_process_webkit/indexed_db_dispatcher_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/in_process_webkit/indexed_db_dispatcher_host.h"
 
 #include <vector>
 
 #include "base/bind.h"
 #include "base/command_line.h"
@@ skipping 457 matching lines @@
     const IndexedDBHostMsg_DatabasePut_Params& params) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::WEBKIT_DEPRECATED));
 
   WebIDBDatabase* database = parent_->GetOrTerminateProcess(
       &map_, params.ipc_database_id);
   if (!database)
     return;
   scoped_ptr<WebIDBCallbacks> callbacks(
       new IndexedDBCallbacks<WebIDBKey>(parent_, params.ipc_thread_id,
                                         params.ipc_response_id));
+  if (params.index_ids.size() != params.index_keys.size()) {
+    callbacks->onError(WebIDBDatabaseError(
+        WebKit::WebIDBDatabaseExceptionUnknownError,
+        "Malformed IPC message: index_ids.size() != index_keys.size()"));
+    return;
+  }
 
   WebVector<unsigned char> value(params.value);
   int64 host_transaction_id = parent_->HostTransactionId(params.transaction_id);
   database->put(host_transaction_id,
                 params.object_store_id,
                 &value, params.key,
                 params.put_mode, callbacks.release(),
                 params.index_ids,
                 params.index_keys);
   TransactionIDToSizeMap* map =
       &parent_->database_dispatcher_host_->transaction_size_map_;
   // Size can't be big enough to overflow because it represents the
   // actual bytes passed through IPC.
   (*map)[host_transaction_id] += params.value.size();
 }
 
 void IndexedDBDispatcherHost::DatabaseDispatcherHost::OnSetIndexKeys(
     const IndexedDBHostMsg_DatabaseSetIndexKeys_Params& params) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::WEBKIT_DEPRECATED));
   WebIDBDatabase* database = parent_->GetOrTerminateProcess(
       &map_, params.ipc_database_id);
   if (!database)
     return;
 
-  database->setIndexKeys(parent_->HostTransactionId(params.transaction_id),
+  int64 host_transaction_id = parent_->HostTransactionId(params.transaction_id);
+  if (params.index_ids.size() != params.index_keys.size()) {
+    database->abort(host_transaction_id, WebIDBDatabaseError(
+        WebKit::WebIDBDatabaseExceptionUnknownError,
+        "Malformed IPC message: index_ids.size() != index_keys.size()"));
+    return;
+  }
+
+  database->setIndexKeys(host_transaction_id,
                          params.object_store_id,
                          params.primary_key, params.index_ids,
                          params.index_keys);
 }
 
 void IndexedDBDispatcherHost::DatabaseDispatcherHost::OnSetIndexesReady(
     int32 ipc_database_id,
     int64 transaction_id,
     int64 object_store_id,
     const std::vector<int64>& index_ids) {
@@ skipping 275 matching lines @@
                                                        ipc_response_id), ec);
   DCHECK(!ec);
 }
 
 void IndexedDBDispatcherHost::CursorDispatcherHost::OnDestroyed(
     int32 ipc_object_id) {
   parent_->DestroyObject(&map_, ipc_object_id);
 }
 
 }  // namespace content