| Index: chrome/browser/spellcheck_host.cc
|
| ===================================================================
|
| --- chrome/browser/spellcheck_host.cc (revision 65173)
|
| +++ chrome/browser/spellcheck_host.cc (working copy)
|
| @@ -24,6 +24,7 @@
|
| #include "chrome/common/pref_names.h"
|
| #include "chrome/common/spellcheck_common.h"
|
| #include "googleurl/src/gurl.h"
|
| +#include "third_party/hunspell/google/bdict.h"
|
|
|
| namespace {
|
|
|
| @@ -287,6 +288,16 @@
|
| void SpellCheckHost::SaveDictionaryData() {
|
| DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
|
|
|
| + // To prevent corrupted dictionary data from causing a renderer crash, scan
|
| + // the dictionary data and verify it is sane before save it to a file.
|
| + if (!hunspell::BDict::Verify(data_.data(), data_.size())) {
|
| + LOG(ERROR) << "Failure to verify the downloaded dictionary.";
|
| + BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
|
| + NewRunnableMethod(this,
|
| + &SpellCheckHost::InformObserverOfInitialization));
|
| + return;
|
| + }
|
| +
|
| size_t bytes_written =
|
| file_util::WriteFile(bdict_file_path_, data_.data(), data_.length());
|
| if (bytes_written != data_.length()) {
|
|
|