Merge 183141

content/browser/renderer_host/database_message_filter.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/database_message_filter.h"
 
 #include <string>
 
 #include "base/bind.h"
 #include "base/platform_file.h"
@@ skipping 266 matching lines @@
     available = quota - usage;
   DatabaseHostMsg_GetSpaceAvailable::WriteReplyParams(reply_msg, available);
   Send(reply_msg);
 }
 
 void DatabaseMessageFilter::OnDatabaseOpened(const string16& origin_identifier,
                                              const string16& database_name,
                                              const string16& description,
                                              int64 estimated_size) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
+
+  if (!DatabaseUtil::IsValidOriginIdentifier(origin_identifier)) {
+    RecordAction(UserMetricsAction("BadMessageTerminate_DBMF"));
+    BadMessageReceived();
+    return;
+  }
+
   int64 database_size = 0;
   db_tracker_->DatabaseOpened(origin_identifier, database_name, description,
                               estimated_size, &database_size);
   database_connections_.AddConnection(origin_identifier, database_name);
   Send(new DatabaseMsg_UpdateSize(origin_identifier, database_name,
                                   database_size));
 }
 
 void DatabaseMessageFilter::OnDatabaseModified(
     const string16& origin_identifier,
@@ skipping 21 matching lines @@
 
   database_connections_.RemoveConnection(origin_identifier, database_name);
   db_tracker_->DatabaseClosed(origin_identifier, database_name);
 }
 
 void DatabaseMessageFilter::OnHandleSqliteError(
     const string16& origin_identifier,
     const string16& database_name,
     int error) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
+  if (!DatabaseUtil::IsValidOriginIdentifier(origin_identifier)) {
+    RecordAction(UserMetricsAction("BadMessageTerminate_DBMF"));
+    BadMessageReceived();
+    return;
+  }
+
   db_tracker_->HandleSqliteError(origin_identifier, database_name, error);
 }
 
 void DatabaseMessageFilter::OnDatabaseSizeChanged(
     const string16& origin_identifier,
     const string16& database_name,
     int64 database_size) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
   if (database_connections_.IsOriginUsed(origin_identifier)) {
     Send(new DatabaseMsg_UpdateSize(origin_identifier, database_name,
                                     database_size));
   }
 }
 
 void DatabaseMessageFilter::OnDatabaseScheduledForDeletion(
     const string16& origin_identifier,
     const string16& database_name) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
   Send(new DatabaseMsg_CloseImmediately(origin_identifier, database_name));
 }
 
 }  // namespace content