[Autofill] Bail on corrupt AutofillHostMsg_ShowPasswordSuggestions message

components/autofill/core/browser/autofill_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/autofill/core/browser/autofill_manager.h"
 
 #include <stddef.h>
 
 #include <limits>
 #include <map>
@@ skipping 591 matching lines @@
       const FormFieldData& form,
       const PasswordFormFillData& fill_data) {
   external_delegate_->AddPasswordFormMapping(form, fill_data);
 }
 
 void AutofillManager::OnShowPasswordSuggestions(
     const FormFieldData& field,
     const gfx::RectF& bounds,
     const std::vector<base::string16>& suggestions,
     const std::vector<base::string16>& realms) {
+  // Bail if the IPC message is corrupt.
+  if (suggestions.size() != realms.size())

[palmer, 2013/12/20 00:08:08]

Does it also make sense to set some minimum and/or maximum size for these
vectors? (And below.)

[Ilya Sherman, 2013/12/20 00:15:00]

Hmm, we already check this in the renderer, so I guess this only applies if the
renderer is misbehaving.  If the renderer is misbehaving, is it worse to have
large sizes in the browser process than in the renderer process?

+    return;
+
   external_delegate_->OnShowPasswordSuggestions(suggestions,
                                                 realms,
                                                 field,
                                                 bounds);
 }
 
 void AutofillManager::OnSetDataList(const std::vector<base::string16>& values,
                                     const std::vector<base::string16>& labels) {
+  // Bail if the IPC message is corrupt.
   if (values.size() != labels.size())
     return;
 
   external_delegate_->SetCurrentDataListValues(values, labels);
 }
 
 void AutofillManager::OnLoadedServerPredictions(
     const std::string& response_xml) {
   // Parse and store the server predictions.
   FormStructure::ParseQueryResponse(response_xml,
@@ skipping 470 matching lines @@
     return false;
 
   // Disregard forms that we wouldn't ever autofill in the first place.
   if (!form.ShouldBeParsed(true))
     return false;
 
   return true;
 }
 
 }  // namespace autofill