Add size checks to extension icons to prevent out of memory conditions

chrome/browser/ui/webui/favicon_source.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/favicon_source.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "chrome/browser/favicon/favicon_service_factory.h"
 #include "chrome/browser/history/top_sites.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/webui/web_ui_util.h"
 #include "chrome/common/url_constants.h"
 #include "grit/locale_settings.h"
 #include "grit/ui_resources.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/layout.h"
 #include "ui/base/resource/resource_bundle.h"
 
+const int kMaxIconSize = 256;
+
 FaviconSource::FaviconSource(Profile* profile, IconType type)
     : DataSource(type == FAVICON ? chrome::kChromeUIFaviconHost :
                      chrome::kChromeUITouchIconHost,
                  MessageLoop::current()) {
   Init(profile, type);
 }
 
 FaviconSource::FaviconSource(Profile* profile,
                              IconType type,
                              const std::string& source_name)
@@ skipping 45 matching lines @@
                    base::Unretained(this),
                    IconRequest(request_id, size_in_dip, scale_factor)),
         &cancelable_task_tracker_);
   } else {
     GURL url;
     if (path.size() > 5 && path.substr(0, 5) == "size/") {
       size_t slash = path.find("/", 5);
       size_t scale_delimiter = path.find("@", 5);
       std::string size = path.substr(5, slash - 5);
       size_in_dip = atoi(size.c_str());
       DCHECK(size_in_dip == 64 || size_in_dip == 32 || size_in_dip == 16) <<

[Matt Perry, 2012/12/14 18:57:08]

This DCHECK suggests that we only expect 16, 32, and 64 sized icons. Turn it
into an if statement and just set the size to 16 if it doesn't match one of
these.

           "only 64x64, 32x32 and 16x16 icons are supported";
+      if (size_in_dip > kMaxIconSize) {
+        // Note that actual size can be more than kMaxIconSize
+        // because of scale_factor
+        size_in_dip = kMaxIconSize;
+      }
       // Optional scale factor.
       if (scale_delimiter != std::string::npos && scale_delimiter < slash) {
         DCHECK(size_in_dip == 16);
         std::string scale_str = path.substr(scale_delimiter + 1,
                                             slash - scale_delimiter - 1);
         web_ui_util::ParseScaleFactor(scale_str, &scale_factor);
       }
       url = GURL(path.substr(slash + 1));
     } else {
       // URL requests prefixed with "origin/" are converted to a form with an
@@ skipping 81 matching lines @@
 
   if (!default_favicon) {
     ui::ScaleFactor scale_factor = icon_request.scale_factor;
     default_favicon = ResourceBundle::GetSharedInstance()
         .LoadDataResourceBytesForScale(resource_id, scale_factor);
     default_favicons_[favicon_index] = default_favicon;
   }
 
   SendResponse(icon_request.request_id, default_favicon);
 }