Prevent calling internal metrics code with invalid values.

chrome/browser/extensions/extension_metrics_module.cc

Index: chrome/browser/extensions/extension_metrics_module.cc
diff --git a/chrome/browser/extensions/extension_metrics_module.cc b/chrome/browser/extensions/extension_metrics_module.cc
index 48e5d0821093446bf1b9ea2f863f0f661f549ebf..a049f828dd26001c47ac88c1feebf7ef6022fe45 100644
--- a/chrome/browser/extensions/extension_metrics_module.cc
+++ b/chrome/browser/extensions/extension_metrics_module.cc
@@ -4,6 +4,8 @@
 
 #include "chrome/browser/extensions/extension_metrics_module.h"
 
+#include <algorithm>
+
 #include "base/metrics/histogram.h"
 #include "chrome/common/extensions/extension.h"
 #include "content/public/browser/user_metrics.h"
@@ -12,6 +14,10 @@ using base::Histogram;
 using base::LinearHistogram;
 using content::UserMetricsAction;
 
+const size_t kMaxBuckets = 10000; // We don't ever want more than these many
+                                  // buckets; there is no real need for them
+                                  // and would cause crazy memory usage
+
 bool MetricsRecordUserActionFunction::RunImpl() {
   std::string name;
   EXTENSION_FUNCTION_VALIDATE(args_->GetString(0, &name));
@@ -33,6 +39,19 @@ bool MetricsHistogramHelperFunction::RecordValue(const std::string& name,
                                                  int max,
                                                  size_t buckets,
                                                  int sample) {
+  // Make sure toxic values don't get to internal code.
+  // Fix for minimums.
+  min = std::max(min, 1);
+  max = std::max(max, min + 1);
+  buckets = std::max(buckets, static_cast<size_t>(3));
+  // Fix for maximums
+  min = std::min(min, INT_MAX - 3);
+  max = std::min(max, INT_MAX - 3);

[jar (doing other things), 2012/01/06 02:00:11]

You need to do these before line 44 and 45.

[rkc, 2012/01/06 02:08:25]

Done.

+  buckets = std::min(buckets, kMaxBuckets);
+  // Trim buckets down to a maximum of the given range + over/underflow buckets
+  if (buckets > static_cast<size_t>(max - min + 2))
+    buckets = max - min + 2;
+
   Histogram* counter;
   if (type == Histogram::LINEAR_HISTOGRAM) {
     counter = LinearHistogram::FactoryGet(name,