Check the size of ResourceRecords in ServiceWorkerDatabase::ReadRegistration()

content/browser/service_worker/service_worker_database.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/service_worker/service_worker_database.h"
 
 #include "base/files/file_util.h"
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/metrics/histogram.h"
@@ skipping 520 matching lines @@
 
   RegistrationData value;
   status = ReadRegistrationData(registration_id, origin, &value);
   if (status != STATUS_OK)
     return status;
 
   status = ReadResourceRecords(value.version_id, resources);
   if (status != STATUS_OK)
     return status;
 
+  // ResourceRecord must contain the ServiceWorker's main script.
+  if (resources->empty())
+    return ServiceWorkerDatabase::STATUS_ERROR_CORRUPTED;
+
   *registration = value;
   return STATUS_OK;
 }
 
 ServiceWorkerDatabase::Status ServiceWorkerDatabase::ReadRegistrationOrigin(
     int64 registration_id,
     GURL* origin) {
   DCHECK(sequence_checker_.CalledOnValidSequencedThread());
   DCHECK(origin);
 
@@ skipping 25 matching lines @@
   return STATUS_OK;
 }
 
 ServiceWorkerDatabase::Status ServiceWorkerDatabase::WriteRegistration(
     const RegistrationData& registration,
     const std::vector<ResourceRecord>& resources,
     RegistrationData* old_registration,
     std::vector<int64>* newly_purgeable_resources) {
   DCHECK(sequence_checker_.CalledOnValidSequencedThread());
   DCHECK(old_registration);
+  DCHECK(!resources.empty());
   Status status = LazyOpen(true);
   old_registration->version_id = kInvalidServiceWorkerVersionId;
   if (status != STATUS_OK)
     return status;
 
   leveldb::WriteBatch batch;
   BumpNextRegistrationIdIfNeeded(registration.registration_id, &batch);
   BumpNextVersionIdIfNeeded(registration.version_id, &batch);
 
   PutUniqueOriginToBatch(registration.scope.GetOrigin(), &batch);
@@ skipping 856 matching lines @@
 
 void ServiceWorkerDatabase::HandleWriteResult(
     const tracked_objects::Location& from_here,
     Status status) {
   if (status != STATUS_OK)
     Disable(from_here, status);
   ServiceWorkerMetrics::CountWriteDatabaseResult(status);
 }
 
 }  // namespace content