Check that all the hashes ids in the model are valid.

chrome/browser/safe_browsing/client_side_detection_service.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/safe_browsing/client_side_detection_service.h"
 
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/time.h"
 #include "base/memory/scoped_ptr.h"
@@ skipping 281 matching lines @@
   if (!status.is_success() || RC_REQUEST_OK != response_code) {
     model_status = MODEL_FETCH_FAILED;
   } else if (data.empty()) {
     model_status = MODEL_EMPTY;
   } else if (data.size() > kMaxModelSizeBytes) {
     model_status = MODEL_TOO_LARGE;
   } else if (!model->ParseFromString(data)) {
     model_status = MODEL_PARSE_ERROR;
   } else if (!model->IsInitialized() || !model->has_version()) {
     model_status = MODEL_MISSING_FIELDS;
+  } else if (!ModelHasValidHashIds(*model)) {
+    model_status = MODEL_BAD_HASH_IDS;
   } else if (model->version() < 0 ||
              (model_.get() && model->version() < model_->version())) {
     model_status = MODEL_INVALID_VERSION_NUMBER;
   } else if (model_.get() && model->version() == model_->version()) {
     model_status = MODEL_NOT_CHANGED;
   } else {
     // The model is valid => replace the existing model with the new one.
     model_str_.assign(data);
     model_.swap(model);
     model_status = MODEL_SUCCESS;
@@ skipping 140 matching lines @@
     // Basically we need to create a 16B long string which has the highest
     // |size| bits sets to one.
     std::string mask(net::kIPv6AddressSize, '\x00');
     mask.replace(0, size / 8, size / 8, '\xFF');
     if (size % 8) {
       mask[size / 8] = 0xFF << (8 - (size % 8));
     }
     (*bad_subnets)[mask].insert(model.bad_subnet(i).prefix());
   }
 }
+
+/* static */

[mattm, 2011/08/03 20:46:55]

// style comments

[noelutz, 2011/08/03 20:51:53]

Done.

+bool ClientSideDetectionService::ModelHasValidHashIds(
+    const ClientSideModel& model) {
+  const int kMaxIndex = model.hashes_size() - 1;

[mattm, 2011/08/03 20:46:55]

max_index

[noelutz, 2011/08/03 20:51:53]

Done.

+  for (int i = 0; i < model.rule_size(); ++i) {
+    for (int j = 0; j < model.rule(i).feature_size(); ++j) {
+      if (model.rule(i).feature(j) < 0 ||
+          model.rule(i).feature(j) > kMaxIndex) {
+        return false;
+      }
+    }
+  }
+  for (int i = 0; i < model.page_term_size(); ++i) {
+    if (model.page_term(i) < 0 || model.page_term(i) > kMaxIndex) {
+      return false;
+    }
+  }
+  for (int i = 0; i < model.page_word_size(); ++i) {
+    if (model.page_word(i) < 0 || model.page_word(i) > kMaxIndex) {
+      return false;
+    }
+  }
+  return true;
+}
 }  // namespace safe_browsing