Verify promise type before casting.

content/renderer/pepper/content_decryptor_delegate.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/pepper/content_decryptor_delegate.h"
 
 #include "base/callback_helpers.h"
 #include "base/debug/trace_event.h"
 #include "base/message_loop/message_loop_proxy.h"
 #include "base/numerics/safe_conversions.h"
@@ skipping 607 matching lines @@
 
   // TODO(tomfinegan): Need to get stream type from media stack.
   ScopedPPResource pp_resource(encrypted_resource.get());
   plugin_decryption_interface_->DecryptAndDecode(
       pp_instance_, PP_DECRYPTORSTREAMTYPE_VIDEO, pp_resource, &block_info);
   return true;
 }
 
 void ContentDecryptorDelegate::OnPromiseResolved(uint32 promise_id) {
   scoped_ptr<CdmPromise> promise = TakePromise(promise_id);
-  if (promise) {
-    SimpleCdmPromise* simple_promise(
-        static_cast<SimpleCdmPromise*>(promise.get()));
-    simple_promise->resolve();
+  if (!promise ||
+      promise->GetResolveParameterType() != media::CdmPromise::VOID_TYPE) {
+    NOTREACHED();
+    return;
   }
+
+  SimpleCdmPromise* simple_promise(
+      static_cast<SimpleCdmPromise*>(promise.get()));
+  simple_promise->resolve();
 }
 
 void ContentDecryptorDelegate::OnPromiseResolvedWithSession(
     uint32 promise_id,
     PP_Var web_session_id) {
   scoped_ptr<CdmPromise> promise = TakePromise(promise_id);
+  if (!promise ||
+      promise->GetResolveParameterType() != media::CdmPromise::STRING_TYPE) {
+    NOTREACHED();
+    return;
+  }
 
   StringVar* web_session_id_string = StringVar::FromPPVar(web_session_id);
   DCHECK(web_session_id_string);
 
-  if (promise) {
-    NewSessionCdmPromise* session_promise(
-        static_cast<NewSessionCdmPromise*>(promise.get()));
-    session_promise->resolve(web_session_id_string->value());
-  }
+  NewSessionCdmPromise* session_promise(
+      static_cast<NewSessionCdmPromise*>(promise.get()));
+  session_promise->resolve(web_session_id_string->value());
 }
 
 void ContentDecryptorDelegate::OnPromiseRejected(
     uint32 promise_id,
     PP_CdmExceptionCode exception_code,
     uint32 system_code,
     PP_Var error_description) {
   StringVar* error_description_string = StringVar::FromPPVar(error_description);
   DCHECK(error_description_string);
 
@@ skipping 516 matching lines @@
 
 scoped_ptr<CdmPromise> ContentDecryptorDelegate::TakePromise(
     uint32_t promise_id) {
   PromiseMap::iterator it = promises_.find(promise_id);
   if (it == promises_.end())
     return scoped_ptr<CdmPromise>();
   return promises_.take_and_erase(it);
 }
 
 }  // namespace content