Avoid crashing the browser on truncated reads from the cache backend

net/http/http_cache_transaction.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_cache_transaction.h"
 
 #include "build/build_config.h"
 
 #if defined(OS_POSIX)
 #include <unistd.h>
@@ skipping 1367 matching lines @@
     partial_->FixResponseHeaders(response_.headers, true);
   }
   return OK;
 }
 
 int HttpCache::Transaction::DoCacheReadResponse() {
   DCHECK(entry_);
   next_state_ = STATE_CACHE_READ_RESPONSE_COMPLETE;
 
   io_buf_len_ = entry_->disk_entry->GetDataSize(kResponseInfoIndex);
+  if (io_buf_len_ > 0) {
+    UMA_HISTOGRAM_BOOLEAN("HttpCache.HeaderTruncated", false);
+  } else {
+    UMA_HISTOGRAM_BOOLEAN("HttpCache.HeaderTruncated", true);
+    DLOG(WARNING) << "Truncated cache entry header encountered";
+    mode_ = NONE;
+    if (partial_.get())
+      partial_->RestoreHeaders(&custom_request_->extra_headers);
+    next_state_ = STATE_SEND_REQUEST;
+    return OK;
+  }
   read_buf_ = new IOBuffer(io_buf_len_);
 
   net_log_.BeginEvent(NetLog::TYPE_HTTP_CACHE_READ_INFO);
   ReportCacheActionStart();
   return ResetCacheIOStart(
       entry_->disk_entry->ReadData(kResponseInfoIndex, 0, read_buf_,
                                    io_buf_len_, io_callback_));
 }
 
 int HttpCache::Transaction::DoCacheReadResponseComplete(int result) {
@@ skipping 77 matching lines @@
     DoneWritingToEntry(false);
   }
   return OK;
 }
 
 int HttpCache::Transaction::DoCacheReadMetadata() {
   DCHECK(entry_);
   DCHECK(!response_.metadata);
   next_state_ = STATE_CACHE_READ_METADATA_COMPLETE;
 
-  response_.metadata =
-      new IOBufferWithSize(entry_->disk_entry->GetDataSize(kMetadataIndex));
+  int32 data_size = entry_->disk_entry->GetDataSize(kMetadataIndex);
+  if (data_size > 0) {
+    UMA_HISTOGRAM_BOOLEAN("HttpCache.MetadataTruncated", false);
+  } else {
+    UMA_HISTOGRAM_BOOLEAN("HttpCache.MetadataTruncated", true);
+    DLOG(WARNING) << "Truncated cache entry metadata encountered";
+    mode_ = NONE;
+    if (partial_.get())
+      partial_->RestoreHeaders(&custom_request_->extra_headers);
+    next_state_ = STATE_SEND_REQUEST;
+    return OK;
+  }
+  response_.metadata = new IOBufferWithSize(data_size);
 
   net_log_.BeginEvent(NetLog::TYPE_HTTP_CACHE_READ_INFO);
   ReportCacheActionStart();
   return ResetCacheIOStart(
       entry_->disk_entry->ReadData(kMetadataIndex, 0, response_.metadata,
                                    response_.metadata->size(),
                                    io_callback_));
 }
 
 int HttpCache::Transaction::DoCacheReadMetadataComplete(int result) {
@@ skipping 1059 matching lines @@
 }
 
 int HttpCache::Transaction::ResetCacheIOStart(int return_value) {
   DCHECK(cache_io_start_.is_null());
   if (return_value == ERR_IO_PENDING)
     cache_io_start_ = base::TimeTicks::Now();
   return return_value;
 }
 
 }  // namespace net