Added bounds checks to the URLLoader prefetch buffer threshhold.

webkit/plugins/ppapi/ppb_url_request_info_impl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/plugins/ppapi/ppb_url_request_info_impl.h"
 
 #include "base/logging.h"
 #include "base/string_util.h"
 #include "googleurl/src/gurl.h"
 #include "googleurl/src/url_util.h"
@@ skipping 113 matching lines @@
 }
 
 bool PPB_URLRequestInfo_Impl::RequiresUniversalAccess() const {
   return
       data().has_custom_referrer_url ||
       data().has_custom_content_transfer_encoding ||
       url_util::FindAndCompareScheme(data().url, "javascript", NULL);
 }
 
 bool PPB_URLRequestInfo_Impl::ValidateData() {
+  if (data().prefetch_buffer_lower_threshold < 0 ||
+      data().prefetch_buffer_upper_threshold < 0 ||
+      data().prefetch_buffer_upper_threshold <=
+      data().prefetch_buffer_lower_threshold) {
+    return false;
+  }
+
   // Get the Resource objects for any file refs with only host resource (this
   // is the state of the request as it comes off IPC).
   for (size_t i = 0; i < data().body.size(); ++i) {
     PPB_URLRequestInfo_Data::BodyItem& item = data().body[i];
     if (item.is_file && !item.file_ref) {
       EnterResourceNoLock<PPB_FileRef_API> enter(
           item.file_ref_host_resource.host_resource(), false);
       if (!enter.succeeded())
         return false;
       item.file_ref = enter.resource();
@@ skipping 40 matching lines @@
       webkit_glue::FilePathToWebString(platform_path),
       start_offset,
       number_of_bytes,
       expected_last_modified_time);
   return true;
 }
 
 
 }  // namespace ppapi
 }  // namespace webkit