Fix a crash when saving a <canvas> or <img> image which is large.

content/browser/renderer_host/render_message_filter.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_message_filter.h"
 
 #include <map>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ skipping 13 matching lines @@
 #include "content/browser/media/media_internals.h"
 #include "content/browser/plugin_process_host.h"
 #include "content/browser/renderer_host/pepper/pepper_security_helper.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_delegate.h"
 #include "content/browser/renderer_host/render_widget_helper.h"
 #include "content/browser/renderer_host/render_widget_resize_helper.h"
 #include "content/browser/transition_request_manager.h"
 #include "content/common/child_process_host_impl.h"
 #include "content/common/child_process_messages.h"
+#include "content/common/content_constants_internal.h"
 #include "content/common/cookie_data.h"
 #include "content/common/desktop_notification_messages.h"
 #include "content/common/frame_messages.h"
 #include "content/common/host_shared_bitmap_manager.h"
 #include "content/common/media/media_param_traits.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/browser_child_process_host.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
@@ skipping 345 matching lines @@
                         OnCreateFullscreenWidget)
     IPC_MESSAGE_HANDLER(ViewHostMsg_SetCookie, OnSetCookie)
     IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_GetCookies, OnGetCookies)
     IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_GetRawCookies, OnGetRawCookies)
     IPC_MESSAGE_HANDLER(ViewHostMsg_DeleteCookie, OnDeleteCookie)
     IPC_MESSAGE_HANDLER(ViewHostMsg_CookiesEnabled, OnCookiesEnabled)
 #if defined(OS_MACOSX)
     IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_LoadFont, OnLoadFont)
 #endif
     IPC_MESSAGE_HANDLER(ViewHostMsg_DownloadUrl, OnDownloadUrl)
+    IPC_MESSAGE_HANDLER(ViewHostMsg_SaveImageFromDataURL,
+                        OnSaveImageFromDataURL)
 #if defined(ENABLE_PLUGINS)
     IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_GetPlugins, OnGetPlugins)
     IPC_MESSAGE_HANDLER(FrameHostMsg_GetPluginInfo, OnGetPluginInfo)
     IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_OpenChannelToPlugin,
                                     OnOpenChannelToPlugin)
     IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_OpenChannelToPepperPlugin,
                                     OnOpenChannelToPepperPlugin)
     IPC_MESSAGE_HANDLER(ViewHostMsg_DidCreateOutOfProcessPepperInstance,
                         OnDidCreateOutOfProcessPepperInstance)
     IPC_MESSAGE_HANDLER(ViewHostMsg_DidDeleteOutOfProcessPepperInstance,
@@ skipping 449 matching lines @@
       media::AudioManagerBase::kDefaultDeviceId);
 }
 
 #if defined(OS_WIN)
 void RenderMessageFilter::OnGetMonitorColorProfile(std::vector<char>* profile) {
   DCHECK(!BrowserThread::CurrentlyOn(BrowserThread::IO));
   *profile = g_color_profile.Get().profile();
 }
 #endif
 
-void RenderMessageFilter::OnDownloadUrl(int render_view_id,
-                                        const GURL& url,
-                                        const Referrer& referrer,
-                                        const base::string16& suggested_name,
-                                        const bool use_prompt) {
+void RenderMessageFilter::DownloadUrl(int render_view_id,
+                                      const GURL& url,
+                                      const Referrer& referrer,
+                                      const base::string16& suggested_name,
+                                      const bool use_prompt) {
   scoped_ptr<DownloadSaveInfo> save_info(new DownloadSaveInfo());
   save_info->suggested_name = suggested_name;
   save_info->prompt_for_save_location = use_prompt;
 
   // There may be a special cookie store that we could use for this download,
   // rather than the default one. Since this feature is generally only used for
   // proper render views, and not downloads, we do not need to retrieve the
   // special cookie store here, but just initialize the request to use the
   // default cookie store.
   // TODO(tburkard): retrieve the appropriate special cookie store, if this
   // is ever to be used for downloads as well.
   scoped_ptr<net::URLRequest> request(
       resource_context_->GetRequestContext()->CreateRequest(
           url, net::DEFAULT_PRIORITY, NULL, NULL));
   RecordDownloadSource(INITIATED_BY_RENDERER);
   resource_dispatcher_host_->BeginDownload(
       request.Pass(),
       referrer,
       true,  // is_content_initiated
       resource_context_,
       render_process_id_,
       render_view_id,
       false,
       save_info.Pass(),
       DownloadItem::kInvalidId,
       ResourceDispatcherHostImpl::DownloadStartedCallback());
 }
 
+void RenderMessageFilter::OnDownloadUrl(int render_view_id,
+                                        const GURL& url,
+                                        const Referrer& referrer,
+                                        const base::string16& suggested_name) {
+  DownloadUrl(render_view_id, url, referrer, suggested_name, false);
+}
+
+void RenderMessageFilter::OnSaveImageFromDataURL(int render_view_id,
+                                                 const std::string& data_url) {
+  // Please refer to RenderViewImpl::saveImageFromDataURL().
+  if (data_url.length() < kMaxLengthOfDataURLString)
+    DownloadUrl(render_view_id, GURL(data_url),

[Ken Russell (switch to Gerrit), 2014/09/11 00:38:53]

Please construct the GURL in a separate statement and verify that the scheme is
"data", returning immediately if not (or if something else went wrong in GURL
construction). The browser does not trust the renderer. All assumptions about
incoming inputs must be verified.

[zino, 2014/09/12 09:38:27]

Done.

+        Referrer(), base::string16(), true);
+}
+
 void RenderMessageFilter::OnCheckNotificationPermission(
     const GURL& source_origin, int* result) {
 #if defined(ENABLE_NOTIFICATIONS)
   *result = GetContentClient()->browser()->
       CheckDesktopNotificationPermission(source_origin, resource_context_,
                                          render_process_id_);
 #else
   *result = blink::WebNotificationPresenter::PermissionAllowed;
 #endif
 }
@@ skipping 314 matching lines @@
     int render_frame_id,
     const std::string& allowed_destination_host_pattern,
     const std::string& selector,
     const std::string& markup) {
   TransitionRequestManager::GetInstance()->AddPendingTransitionRequestData(
       render_process_id_, render_frame_id, allowed_destination_host_pattern,
       selector, markup);
 }
 
 }  // namespace content