Improve handling of invalid frame ID in MSDH::OnCancelDeviceChangeNotifications

content/browser/renderer_host/media/media_stream_dispatcher_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/media/media_stream_dispatcher_host.h"
 
 #include <algorithm>
 
 #include "base/command_line.h"
 #include "base/memory/ptr_util.h"
+#include "content/browser/bad_message.h"
 #include "content/browser/browser_main_loop.h"
 #include "content/browser/renderer_host/media/media_stream_ui_proxy.h"
 #include "content/common/media/media_stream_messages.h"
 #include "content/common/media/media_stream_options.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/common/content_switches.h"
 #include "url/gurl.h"
 
 namespace content {
 
@@ skipping 247 matching lines @@
 void MediaStreamDispatcherHost::OnCancelDeviceChangeNotifications(
     int render_frame_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   DVLOG(1) << "MediaStreamDispatcherHost::CancelDeviceChangeNotifications("
            << render_frame_id << ")";
   auto it = std::find_if(
       device_change_subscribers_.begin(), device_change_subscribers_.end(),
       [render_frame_id](const DeviceChangeSubscriberInfo& subscriber_info) {
         return subscriber_info.render_frame_id == render_frame_id;
       });
-  CHECK(it != device_change_subscribers_.end());
+  if (it == device_change_subscribers_.end()) {
+    bad_message::ReceivedBadMessage(this, bad_message::MSDH_INVALID_FRAME_ID);
+    return;
+  }
   device_change_subscribers_.erase(it);
   if (device_change_subscribers_.empty())
     media_stream_manager_->CancelDeviceChangeNotifications(this);
 }
 
 std::unique_ptr<MediaStreamUIProxy>
 MediaStreamDispatcherHost::CreateMediaStreamUIProxy() {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   if (use_fake_ui_ ||
       base::CommandLine::ForCurrentProcess()->HasSwitch(
@@ skipping 16 matching lines @@
 void MediaStreamDispatcherHost::OnSetCapturingLinkSecured(int session_id,
                                                           MediaStreamType type,
                                                           bool is_secure) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   media_stream_manager_->SetCapturingLinkSecured(render_process_id_, session_id,
                                                  type, is_secure);
 }
 
 }  // namespace content