Check that all the hashes ids in the model are valid.

chrome/browser/safe_browsing/client_side_detection_service.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/safe_browsing/client_side_detection_service.h"
 
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/time.h"
 #include "base/memory/scoped_ptr.h"
@@ skipping 58 matching lines @@
                  NotificationService::AllSources());
 }
 
 ClientSideDetectionService::~ClientSideDetectionService() {
   method_factory_.RevokeAll();
   STLDeleteContainerPairPointers(client_phishing_reports_.begin(),
                                  client_phishing_reports_.end());
   client_phishing_reports_.clear();
 }
 
-/* static */
+// static
 ClientSideDetectionService* ClientSideDetectionService::Create(
     net::URLRequestContextGetter* request_context_getter) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   scoped_ptr<ClientSideDetectionService> service(
       new ClientSideDetectionService(request_context_getter));
   if (!service->InitializePrivateNetworks()) {
     UMA_HISTOGRAM_COUNTS("SBClientPhishing.InitPrivateNetworksFailed", 1);
     return NULL;
   }
   // We fetch the model at every browser restart.  In a lot of cases the model
@@ skipping 202 matching lines @@
   if (!status.is_success() || RC_REQUEST_OK != response_code) {
     model_status = MODEL_FETCH_FAILED;
   } else if (data.empty()) {
     model_status = MODEL_EMPTY;
   } else if (data.size() > kMaxModelSizeBytes) {
     model_status = MODEL_TOO_LARGE;
   } else if (!model->ParseFromString(data)) {
     model_status = MODEL_PARSE_ERROR;
   } else if (!model->IsInitialized() || !model->has_version()) {
     model_status = MODEL_MISSING_FIELDS;
+  } else if (!ModelHasValidHashIds(*model)) {
+    model_status = MODEL_BAD_HASH_IDS;
   } else if (model->version() < 0 ||
              (model_.get() && model->version() < model_->version())) {
     model_status = MODEL_INVALID_VERSION_NUMBER;
   } else if (model_.get() && model->version() == model_->version()) {
     model_status = MODEL_NOT_CHANGED;
   } else {
     // The model is valid => replace the existing model with the new one.
     model_str_.assign(data);
     model_.swap(model);
     model_status = MODEL_SUCCESS;
@@ skipping 114 matching lines @@
       private_networks_.push_back(std::make_pair(ip_number, prefix_length));
     } else {
       DLOG(FATAL) << "Unable to parse IP address range: "
                   << kPrivateNetworks[i];
       return false;
     }
   }
   return true;
 }
 
-/* static */
+// static
 void ClientSideDetectionService::SetBadSubnets(const ClientSideModel& model,
                                                BadSubnetMap* bad_subnets) {
   bad_subnets->clear();
   for (int i = 0; i < model.bad_subnet_size(); ++i) {
     int size = model.bad_subnet(i).size();
     if (size < 0 || size > static_cast<int>(net::kIPv6AddressSize) * 8) {
       DLOG(ERROR) << "Invalid bad subnet size: " << size;
       continue;
     }
     if (model.bad_subnet(i).prefix().size() != crypto::SHA256_LENGTH) {
       DLOG(ERROR) << "Invalid bad subnet prefix length: "
                   << model.bad_subnet(i).prefix().size();
       continue;
     }
     // We precompute the mask for the given subnet size to speed up lookups.
     // Basically we need to create a 16B long string which has the highest
     // |size| bits sets to one.
     std::string mask(net::kIPv6AddressSize, '\x00');
     mask.replace(0, size / 8, size / 8, '\xFF');
     if (size % 8) {
       mask[size / 8] = 0xFF << (8 - (size % 8));
     }
     (*bad_subnets)[mask].insert(model.bad_subnet(i).prefix());
   }
 }
+
+// static
+bool ClientSideDetectionService::ModelHasValidHashIds(
+    const ClientSideModel& model) {
+  const int max_index = model.hashes_size() - 1;
+  for (int i = 0; i < model.rule_size(); ++i) {
+    for (int j = 0; j < model.rule(i).feature_size(); ++j) {
+      if (model.rule(i).feature(j) < 0 ||
+          model.rule(i).feature(j) > max_index) {
+        return false;
+      }
+    }
+  }
+  for (int i = 0; i < model.page_term_size(); ++i) {
+    if (model.page_term(i) < 0 || model.page_term(i) > max_index) {
+      return false;
+    }
+  }
+  for (int i = 0; i < model.page_word_size(); ++i) {
+    if (model.page_word(i) < 0 || model.page_word(i) > max_index) {
+      return false;
+    }
+  }
+  return true;
+}
 }  // namespace safe_browsing