Fix browser crash when parsing invalid Settings Override extension

chrome/common/extensions/manifest_handlers/settings_overrides_handler.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/extensions/manifest_handlers/settings_overrides_handler.h"
 
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/common/extensions/permissions/settings_override_permission.h"
 #include "extensions/common/error_utils.h"
@@ skipping 44 matching lines @@
       *error = extensions::ErrorUtils::FormatErrorMessageUTF16(
           manifest_errors::kInvalidStartupOverrideURL, *i);
     } else {
       urls.push_back(GURL());
       urls.back().Swap(manifest_url.get());
     }
   }
   return urls;
 }
 
+scoped_ptr<ChromeSettingsOverrides::Search_provider> ParseSearchEngine(
+    ChromeSettingsOverrides* overrides,
+    string16* error) {
+  if (!overrides->search_provider)
+    return scoped_ptr<ChromeSettingsOverrides::Search_provider>();
+  if (!CreateManifestURL(overrides->search_provider->favicon_url)) {
+    *error = extensions::ErrorUtils::FormatErrorMessageUTF16(
+        manifest_errors::kInvalidSearchEngineURL,
+        overrides->search_provider->favicon_url);
+    return scoped_ptr<ChromeSettingsOverrides::Search_provider>();
+  }
+  if (!CreateManifestURL(overrides->search_provider->search_url)) {
+    *error = extensions::ErrorUtils::FormatErrorMessageUTF16(
+        manifest_errors::kInvalidSearchEngineURL,
+        overrides->search_provider->search_url);
+    return scoped_ptr<ChromeSettingsOverrides::Search_provider>();
+  }
+  return overrides->search_provider.Pass();
+}
+
 // A www. prefix is not informative and thus not worth the limited real estate
 // in the permissions UI.
 std::string RemoveWwwPrefix(const std::string& url) {
   if (StartsWithASCII(url, kWwwPrefix, false))
     return url.substr(strlen(kWwwPrefix));
   return url;
 }
 
 }  // namespace
 
@@ skipping 14 matching lines @@
 bool SettingsOverridesHandler::Parse(Extension* extension, string16* error) {
   const base::Value* dict = NULL;
   CHECK(extension->manifest()->Get(manifest_keys::kSettingsOverride, &dict));
   scoped_ptr<ChromeSettingsOverrides> settings(
       ChromeSettingsOverrides::FromValue(*dict, error));
   if (!settings)
     return false;
 
   scoped_ptr<SettingsOverrides> info(new SettingsOverrides);
   info->homepage = ParseHomepage(*settings, error);
-  info->search_engine = settings->search_provider.Pass();
+  info->search_engine = ParseSearchEngine(settings.get(), error);
   info->startup_pages = ParseStartupPage(*settings, error);
   if (!info->homepage && !info->search_engine && info->startup_pages.empty()) {
     *error = ASCIIToUTF16(manifest_errors::kInvalidEmptySettingsOverrides);
     return false;
   }
   APIPermissionSet* permission_set =
       PermissionsData::GetInitialAPIPermissions(extension);
   DCHECK(permission_set);
   if (info->search_engine) {
     permission_set->insert(new SettingsOverrideAPIPermission(
@@ skipping 16 matching lines @@
   extension->SetManifestData(manifest_keys::kSettingsOverride,
                              info.release());
   return true;
 }
 
 const std::vector<std::string> SettingsOverridesHandler::Keys() const {
   return SingleKey(manifest_keys::kSettingsOverride);
 }
 
 }  // namespace extensions