Prevent calling internal metrics code with invalid values.

chrome/browser/extensions/extension_metrics_module.cc

-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_metrics_module.h"
 
+#include <algorithm>
+
 #include "base/metrics/histogram.h"
 #include "chrome/common/extensions/extension.h"
 #include "content/public/browser/user_metrics.h"
 
 using base::Histogram;
 using base::LinearHistogram;
 using content::UserMetricsAction;
 
+const size_t kMaxBuckets = 10000; // We don't ever want more than these many
+                                  // buckets; there is no real need for them
+                                  // and would cause crazy memory usage
+
 bool MetricsRecordUserActionFunction::RunImpl() {
   std::string name;
   EXTENSION_FUNCTION_VALIDATE(args_->GetString(0, &name));
 
   content::RecordComputedAction(name);
   return true;
 }
 
 bool MetricsHistogramHelperFunction::GetNameAndSample(std::string* name,
                                                       int* sample) {
   EXTENSION_FUNCTION_VALIDATE(args_->GetString(0, name));
   EXTENSION_FUNCTION_VALIDATE(args_->GetInteger(1, sample));
   return true;
 }
 
 bool MetricsHistogramHelperFunction::RecordValue(const std::string& name,
                                                  Histogram::ClassType type,
                                                  int min,
                                                  int max,
                                                  size_t buckets,
                                                  int sample) {
+  // Make sure toxic values don't get to internal code.
+  // Fix for maximums
+  min = std::min(min, INT_MAX - 3);
+  max = std::min(max, INT_MAX - 3);
+  buckets = std::min(buckets, kMaxBuckets);
+  // Fix for minimums.
+  min = std::max(min, 1);
+  max = std::max(max, min + 1);
+  buckets = std::max(buckets, static_cast<size_t>(3));
+  // Trim buckets down to a maximum of the given range + over/underflow buckets
+  if (buckets > static_cast<size_t>(max - min + 2))
+    buckets = max - min + 2;
+
   Histogram* counter;
   if (type == Histogram::LINEAR_HISTOGRAM) {
     counter = LinearHistogram::FactoryGet(name,
                                           min,
                                           max,
                                           buckets,
                                           Histogram::kUmaTargetedHistogramFlag);
   } else {
     counter = Histogram::FactoryGet(name,
                                     min,
@@ skipping 74 matching lines @@
   return RecordValue(name, Histogram::HISTOGRAM, 1, kThreeMinMs, 50, sample);
 }
 
 bool MetricsRecordLongTimeFunction::RunImpl() {
   std::string name;
   int sample;
   EXTENSION_FUNCTION_VALIDATE(GetNameAndSample(&name, &sample));
   static const int kOneHourMs = 60 * 60 * 1000;
   return RecordValue(name, Histogram::HISTOGRAM, 1, kOneHourMs, 50, sample);
 }