If speech input is disabled and we receive IPC calls, terminate the renderer.

chrome/browser/speech/speech_input_dispatcher_host.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/speech/speech_input_dispatcher_host.h"
 
 #include "base/lazy_instance.h"
+#include "chrome/browser/renderer_host/render_process_host.h"
 #include "chrome/common/render_messages.h"
 
 namespace speech_input {
 
 //----------------------------- SpeechInputCallers -----------------------------
 
 // A singleton class to map the tuple
 // (render-process-id, render-view-id, requestid) to a single ID which is passed
 // through rest of the speech code.
 class SpeechInputDispatcherHost::SpeechInputCallers {
@@ skipping 96 matching lines @@
 SpeechInputDispatcherHost::~SpeechInputDispatcherHost() {
 }
 
 SpeechInputManager* SpeechInputDispatcherHost::manager() {
   return (*manager_accessor_)();
 }
 
 bool SpeechInputDispatcherHost::OnMessageReceived(
     const IPC::Message& message, bool* message_was_ok) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
-  bool handled = true;
-  IPC_BEGIN_MESSAGE_MAP_EX(SpeechInputDispatcherHost, message, *message_was_ok)
-    IPC_MESSAGE_HANDLER(ViewHostMsg_SpeechInput_StartRecognition,
-                        OnStartRecognition)
-    IPC_MESSAGE_HANDLER(ViewHostMsg_SpeechInput_CancelRecognition,
-                        OnCancelRecognition)
-    IPC_MESSAGE_HANDLER(ViewHostMsg_SpeechInput_StopRecording,
-                        OnStopRecording)
-    IPC_MESSAGE_UNHANDLED(handled = false)
-  IPC_END_MESSAGE_MAP()
-  return handled;
+
+  uint32 message_type = message.type();
+  if (message_type == ViewHostMsg_SpeechInput_StartRecognition::ID ||
+      message_type == ViewHostMsg_SpeechInput_CancelRecognition::ID ||
+      message_type == ViewHostMsg_SpeechInput_StopRecording::ID) {
+    if (!SpeechInputManager::IsFeatureEnabled()) {
+      RenderProcessHost::FromID(render_process_id_)->ReceivedBadMessage();
+      return false;
+    }
+
+    IPC_BEGIN_MESSAGE_MAP_EX(SpeechInputDispatcherHost, message,
+                             *message_was_ok)
+      IPC_MESSAGE_HANDLER(ViewHostMsg_SpeechInput_StartRecognition,
+                          OnStartRecognition)
+      IPC_MESSAGE_HANDLER(ViewHostMsg_SpeechInput_CancelRecognition,
+                          OnCancelRecognition)
+      IPC_MESSAGE_HANDLER(ViewHostMsg_SpeechInput_StopRecording,
+                          OnStopRecording)
+    IPC_END_MESSAGE_MAP()
+    return true;
+  }
+
+  return false;
 }
 
 void SpeechInputDispatcherHost::OnStartRecognition(
     int render_view_id,
     int request_id,
     const gfx::Rect& element_rect,
     const std::string& language,
     const std::string& grammar) {
   int caller_id = g_speech_input_callers.Get().CreateId(
       render_process_id_, render_view_id, request_id);
@@ skipping 53 matching lines @@
     g_speech_input_callers.Get().render_view_id(caller_id);
   int caller_request_id = g_speech_input_callers.Get().request_id(caller_id);
   Send(new ViewMsg_SpeechInput_RecognitionComplete(caller_render_view_id,
                                                    caller_request_id));
   // Request sequence ended, so remove mapping.
   g_speech_input_callers.Get().RemoveId(caller_id);
   VLOG(1) << "SpeechInputDispatcherHost::DidCompleteRecognition exit";
 }
 
 }  // namespace speech_input