Linux: add a check for suspicious data in KWallet pickles and ignore it.

chrome/browser/password_manager/native_backend_kwallet_x.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/password_manager/native_backend_kwallet_x.h"
 
 #include <sstream>
 
 #include "base/logging.h"
 #include "base/pickle.h"
@@ skipping 493 matching lines @@
     return;
   }
 
   size_t count = 0;
   if (!pickle.ReadSize(&iter, &count)) {
     LOG(ERROR) << "Failed to deserialize KWallet entry "
                << "(realm: " << signon_realm << ")";
     return;
   }
 
+  if (count > 0xFFFF) {
+    // Trying to pin down the cause of http://crbug.com/80728 (or fix it).
+    // This is a very large number of passwords to be saved for a single realm.
+    // It is almost certainly a corrupt pickle and not real data. Ignore it.
+    LOG(ERROR) << "Suspiciously large number of entries in KWallet entry "
+               << "(" << count << "; realm: " << signon_realm << ")";
+    return;
+  }
+
   forms->reserve(forms->size() + count);
   for (size_t i = 0; i < count; ++i) {
     scoped_ptr<PasswordForm> form(new PasswordForm());
     form->signon_realm.assign(signon_realm);
 
     int scheme = 0;
     int64 date_created = 0;
     // Note that these will be read back in the order listed due to
     // short-circuit evaluation. This is important.
     if (!pickle.ReadInt(&iter, &scheme) ||
@@ skipping 75 matching lines @@
                       G_TYPE_STRING, kAppId,          // appid
                       G_TYPE_INVALID,
                       G_TYPE_BOOLEAN, &success,
                       G_TYPE_INVALID);
     if (CheckError() || !success)
       return kInvalidKWalletHandle;
   }
 
   return handle;
 }