AppCache: Defend against bad IPC messages.

content/browser/appcache/appcache_backend_impl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/appcache/appcache_backend_impl.h"
 
 #include "base/stl_util.h"
 #include "content/browser/appcache/appcache.h"
 #include "content/browser/appcache/appcache_group.h"
 #include "content/browser/appcache/appcache_service_impl.h"
@@ skipping 50 matching lines @@
   host->SetSpawningHostId(process_id_, spawning_host_id);
   return true;
 }
 
 bool AppCacheBackendImpl::SelectCache(
     int host_id,
     const GURL& document_url,
     const int64 cache_document_was_loaded_from,
     const GURL& manifest_url) {
   AppCacheHost* host = GetHost(host_id);
-  if (!host)
+  if (!host || host->was_select_cache_called())
     return false;
 
   host->SelectCache(document_url, cache_document_was_loaded_from,
                     manifest_url);
   return true;
 }
 
 bool AppCacheBackendImpl::SelectCacheForWorker(
     int host_id, int parent_process_id, int parent_host_id) {
   AppCacheHost* host = GetHost(host_id);
-  if (!host)
+  if (!host || host->was_select_cache_called())
     return false;
 
   host->SelectCacheForWorker(parent_process_id, parent_host_id);
   return true;
 }
 
 bool AppCacheBackendImpl::SelectCacheForSharedWorker(
     int host_id, int64 appcache_id) {
   AppCacheHost* host = GetHost(host_id);
-  if (!host)
+  if (!host || host->was_select_cache_called())
     return false;
 
   host->SelectCacheForSharedWorker(appcache_id);
   return true;
 }
 
 bool AppCacheBackendImpl::MarkAsForeignEntry(
     int host_id,
     const GURL& document_url,
     int64 cache_document_was_loaded_from) {
@@ skipping 70 matching lines @@
   }
 
   delete found->second;
 
   // We take onwership.
   host->CompleteTransfer(new_host_id, frontend_);
   found->second = host.release();
 }
 
 }  // namespace content