Add sanity checks of the BDIC files to ConvertDictTest....

chrome/browser/spellcheck_host.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/spellcheck_host.h"
 
 #include <fcntl.h>
 
 #include "app/l10n_util.h"
 #include "base/file_util.h"
 #include "base/logging.h"
 #include "base/path_service.h"
 #include "base/string_split.h"
 #include "base/thread_restrictions.h"
 #include "base/utf_string_conversions.h"
 #include "chrome/browser/prefs/pref_member.h"
 #include "chrome/browser/profile.h"
 #include "chrome/browser/spellcheck_host_observer.h"
 #include "chrome/browser/spellchecker_platform_engine.h"
 #include "chrome/common/chrome_constants.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/net/url_request_context_getter.h"
 #include "chrome/common/notification_service.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/spellcheck_common.h"
 #include "googleurl/src/gurl.h"
+#include "third_party/hunspell/google/bdict.h"
 
 namespace {
 
 FilePath GetFirstChoiceFilePath(const std::string& language) {
   FilePath dict_dir;
   {
     // This should not do blocking IO from the UI thread!
     // Temporarily allow it for now.
     //   http://code.google.com/p/chromium/issues/detail?id=60643
     base::ThreadRestrictions::ScopedAllowIO allow_io;
@@ skipping 243 matching lines @@
   }
 
   data_ = data;
   BrowserThread::PostTask(BrowserThread::FILE, FROM_HERE,
       NewRunnableMethod(this, &SpellCheckHost::SaveDictionaryData));
 }
 
 void SpellCheckHost::SaveDictionaryData() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
 
+  // To prevent corrupted dictionary data from causing a renderer crash, scan
+  // the dictionary data and verify it is sane before save it to a file.
+  if (!hunspell::BDict::Verify(data_.data(), data_.size())) {
+    LOG(ERROR) << "Failure to verify the downloaded dictionary.";
+    BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
+        NewRunnableMethod(this,
+                          &SpellCheckHost::InformObserverOfInitialization));
+    return;
+  }
+
   size_t bytes_written =
       file_util::WriteFile(bdict_file_path_, data_.data(), data_.length());
   if (bytes_written != data_.length()) {
     bool success = false;
 #if defined(OS_WIN)
     bdict_file_path_ = GetFallbackFilePath(bdict_file_path_);
     bytes_written =
         file_util::WriteFile(GetFallbackFilePath(bdict_file_path_),
                                                  data_.data(), data_.length());
     if (bytes_written == data_.length())
       success = true;
 #endif
     data_.clear();
 
     if (!success) {
       LOG(ERROR) << "Failure to save dictionary.";
       file_util::Delete(bdict_file_path_, false);
       // To avoid trying to load a partially saved dictionary, shortcut the
       // Initialize() call.
       BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
           NewRunnableMethod(this,
               &SpellCheckHost::InformObserverOfInitialization));
       return;
     }
   }
 
   data_.clear();
   Initialize();
 }