Add size checks to extension icons to prevent out of memory conditions

chrome/browser/ui/webui/extensions/extension_icon_source.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/extensions/extension_icon_source.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/memory/ref_counted_memory.h"
 #include "base/stl_util.h"
@@ skipping 253 matching lines @@
   if (path_lower.empty() || path_parts.size() < 3)
     return false;
 
   std::string size_param = path_parts.at(1);
   std::string match_param = path_parts.at(2);
   match_param = match_param.substr(0, match_param.find('?'));
 
   int size;
   if (!base::StringToInt(size_param, &size))
     return false;
-  if (size <= 0)
+  if (size <= 0 || size > extension_misc::EXTENSION_ICON_GIGANTOR)
     return false;
 
   ExtensionIconSet::MatchType match_type;
   int match_num;
   if (!base::StringToInt(match_param, &match_num))
     return false;
   match_type = static_cast<ExtensionIconSet::MatchType>(match_num);
   if (!(match_type == ExtensionIconSet::MATCH_EXACTLY ||
         match_type == ExtensionIconSet::MATCH_SMALLER ||
         match_type == ExtensionIconSet::MATCH_BIGGER))
@@ skipping 41 matching lines @@
 
 void ExtensionIconSource::ClearData(int request_id) {
   std::map<int, ExtensionIconRequest*>::iterator i =
       request_map_.find(request_id);
   if (i == request_map_.end())
     return;
 
   delete i->second;
   request_map_.erase(i);
 }