Added bounds checks to the URLLoader prefetch buffer threshhold.

webkit/plugins/ppapi/ppb_url_request_info_impl.cc

Index: webkit/plugins/ppapi/ppb_url_request_info_impl.cc
diff --git a/webkit/plugins/ppapi/ppb_url_request_info_impl.cc b/webkit/plugins/ppapi/ppb_url_request_info_impl.cc
index dcea987c90d25131cf4c8006ea4dc58eb66132d0..eb2ba2778217ece7e3ae73301a1405f9b0b0e6ff 100644
--- a/webkit/plugins/ppapi/ppb_url_request_info_impl.cc
+++ b/webkit/plugins/ppapi/ppb_url_request_info_impl.cc
@@ -131,6 +131,13 @@ bool PPB_URLRequestInfo_Impl::RequiresUniversalAccess() const {
 }
 
 bool PPB_URLRequestInfo_Impl::ValidateData() {
+  if (data().prefetch_buffer_lower_threshold < 0 ||
+      data().prefetch_buffer_upper_threshold < 0 ||
+      data().prefetch_buffer_upper_threshold <=
+      data().prefetch_buffer_lower_threshold) {
+    return false;
+  }
+
   // Get the Resource objects for any file refs with only host resource (this
   // is the state of the request as it comes off IPC).
   for (size_t i = 0; i < data().body.size(); ++i) {