[Autofill] Bail on corrupt AutofillHostMsg_ShowPasswordSuggestions message

components/autofill/core/browser/autofill_manager.cc

Index: components/autofill/core/browser/autofill_manager.cc
diff --git a/components/autofill/core/browser/autofill_manager.cc b/components/autofill/core/browser/autofill_manager.cc
index b780de8caceffd1700b55c08cc61196f365f5c1e..edaa35e780f30ef0430f9d73d7d02e362adaede7 100644
--- a/components/autofill/core/browser/autofill_manager.cc
+++ b/components/autofill/core/browser/autofill_manager.cc
@@ -609,6 +609,10 @@ void AutofillManager::OnShowPasswordSuggestions(
     const gfx::RectF& bounds,
     const std::vector<base::string16>& suggestions,
     const std::vector<base::string16>& realms) {
+  // Bail if the IPC message is corrupt.
+  if (suggestions.size() != realms.size())

[palmer, 2013/12/20 00:08:08]

Does it also make sense to set some minimum and/or maximum size for these
vectors? (And below.)

[Ilya Sherman, 2013/12/20 00:15:00]

Hmm, we already check this in the renderer, so I guess this only applies if the
renderer is misbehaving.  If the renderer is misbehaving, is it worse to have
large sizes in the browser process than in the renderer process?

+    return;
+
   external_delegate_->OnShowPasswordSuggestions(suggestions,
                                                 realms,
                                                 field,
@@ -617,6 +621,7 @@ void AutofillManager::OnShowPasswordSuggestions(
 
 void AutofillManager::OnSetDataList(const std::vector<base::string16>& values,
                                     const std::vector<base::string16>& labels) {
+  // Bail if the IPC message is corrupt.
   if (values.size() != labels.size())
     return;