Validate vector lengths in ImageHostMsg_DidDownloadImage

content/browser/web_contents/web_contents_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/web_contents/web_contents_impl.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/debug/trace_event.h"
@@ skipping 2493 matching lines @@
   browser_plugin_embedder_.reset(BrowserPluginEmbedder::Create(this));
   browser_plugin_embedder_->OnMessageReceived(message);
 }
 
 void WebContentsImpl::OnDidDownloadImage(
     int id,
     int http_status_code,
     const GURL& image_url,
     const std::vector<SkBitmap>& bitmaps,
     const std::vector<gfx::Size>& original_bitmap_sizes) {
+  if (bitmaps.size() != original_bitmap_sizes.size()) {
+    GetRenderProcessHost()->ReceivedBadMessage();
+    return;
+  }
+
   ImageDownloadMap::iterator iter = image_download_map_.find(id);
   if (iter == image_download_map_.end()) {
     // Currently WebContents notifies us of ANY downloads so that it is
     // possible to get here.
     return;
   }
   if (!iter->second.is_null()) {
     iter->second.Run(
         id, http_status_code, image_url, bitmaps, original_bitmap_sizes);
   }
@@ skipping 1315 matching lines @@
 }
 
 void WebContentsImpl::OnFrameRemoved(
     RenderViewHostImpl* render_view_host,
     int64 frame_id) {
    FOR_EACH_OBSERVER(WebContentsObserver, observers_,
                      FrameDetached(render_view_host, frame_id));
 }
 
 }  // namespace content