AppCache: Defend against bad IPC messages.

content/browser/appcache/appcache_host.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/appcache/appcache_host.h"
 
 #include "base/logging.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "content/browser/appcache/appcache.h"
@@ skipping 31 matching lines @@
 
 }  // Anonymous namespace
 
 AppCacheHost::AppCacheHost(int host_id, AppCacheFrontend* frontend,
                            AppCacheServiceImpl* service)
     : host_id_(host_id),
       spawning_host_id_(kAppCacheNoHostId), spawning_process_id_(0),
       parent_host_id_(kAppCacheNoHostId), parent_process_id_(0),
       pending_main_resource_cache_id_(kAppCacheNoCacheId),
       pending_selected_cache_id_(kAppCacheNoCacheId),
+      was_select_cache_called_(false),
       is_cache_selection_enabled_(true),
       frontend_(frontend), service_(service),
       storage_(service->storage()),
       pending_callback_param_(NULL),
       main_resource_was_namespace_entry_(false),
       main_resource_blocked_(false),
       associated_cache_info_pending_(false) {
   service_->AddObserver(this);
 }
 
@@ skipping 16 matching lines @@
 void AppCacheHost::RemoveObserver(Observer* observer) {
   observers_.RemoveObserver(observer);
 }
 
 void AppCacheHost::SelectCache(const GURL& document_url,
                                const int64 cache_document_was_loaded_from,
                                const GURL& manifest_url) {
   DCHECK(pending_start_update_callback_.is_null() &&
          pending_swap_cache_callback_.is_null() &&
          pending_get_status_callback_.is_null() &&
-         !is_selection_pending());
+         !is_selection_pending() && !was_select_cache_called_);
 
+  was_select_cache_called_ = true;
   if (!is_cache_selection_enabled_) {
     FinishCacheSelection(NULL, NULL);
     return;
   }
 
   origin_in_use_ = document_url.GetOrigin();
   if (service()->quota_manager_proxy() && !origin_in_use_.is_empty())
     service()->quota_manager_proxy()->NotifyOriginInUse(origin_in_use_);
 
   if (main_resource_blocked_)
@@ skipping 45 matching lines @@
   // TODO(michaeln): If there was a manifest URL, the user agent may report
   // to the user that it was ignored, to aid in application development.
   FinishCacheSelection(NULL, NULL);
 }
 
 void AppCacheHost::SelectCacheForWorker(int parent_process_id,
                                         int parent_host_id) {
   DCHECK(pending_start_update_callback_.is_null() &&
          pending_swap_cache_callback_.is_null() &&
          pending_get_status_callback_.is_null() &&
-         !is_selection_pending());
+         !is_selection_pending() && !was_select_cache_called_);
 
+  was_select_cache_called_ = true;
   parent_process_id_ = parent_process_id;
   parent_host_id_ = parent_host_id;
   FinishCacheSelection(NULL, NULL);
 }
 
 void AppCacheHost::SelectCacheForSharedWorker(int64 appcache_id) {
   DCHECK(pending_start_update_callback_.is_null() &&
          pending_swap_cache_callback_.is_null() &&
          pending_get_status_callback_.is_null() &&
-         !is_selection_pending());
+         !is_selection_pending() && !was_select_cache_called_);
 
+  was_select_cache_called_ = true;
   if (appcache_id != kAppCacheNoCacheId) {
     LoadSelectedCache(appcache_id);
     return;
   }
   FinishCacheSelection(NULL, NULL);
 }
 
 // TODO(michaeln): change method name to MarkEntryAsForeign for consistency
 void AppCacheHost::MarkAsForeignEntry(const GURL& document_url,
                                       int64 cache_document_was_loaded_from) {
@@ skipping 369 matching lines @@
   associated_cache_info_pending_ = cache && !cache->is_complete();
   AppCacheInfo info;
   if (cache)
     cache->AssociateHost(this);
 
   FillCacheInfo(cache, manifest_url, GetStatus(), &info);
   frontend_->OnCacheSelected(host_id_, info);
 }
 
 }  // namespace content