Autofill: Set requirements for number of recognized fields in an autofillable form

components/autofill/core/browser/autofill_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/autofill/core/browser/autofill_manager.h"
 
 #include <stddef.h>
 
 #include <limits>
 #include <map>
@@ skipping 368 matching lines @@
                    base::Owned(submitted_form.release()),
                    forms_loaded_timestamps_[form],
                    initial_interaction_timestamp_,
                    timestamp));
   }
 
   return true;
 }
 
 void AutofillManager::OnFormsSeen(const std::vector<FormData>& forms,
+                                  size_t unowned_form_index,
                                   const TimeTicks& timestamp) {
+  if (unowned_form_index > forms.size())

[Evan Stade, 2015/01/22 23:43:45]

when does this happen?

[Lei Zhang, 2015/01/22 23:58:13]

It shouldn't, but we can't trust the IPC from the renderer, so we need to check.
Otherwise a compromised renderer can trivially cause out of bound memory access.

[Evan Stade, 2015/01/23 02:21:46]

at least notreached() then? Can you get an IPC owner to confirm this is the
proper way to handle a compromised renderer? (If you follow my advice on
FormData this becomes irrelevant.)

[Lei Zhang, 2015/01/23 06:59:47]

ValidFormDataVector() below doesn't have a NOTREACHED() either, so I'm being
consistent. Another option is to call ReceivedBadMessage() and kill the
renderer. This CL will touch IPC no matter what, so I'll ask when the time
comes.

+    return;
+
   if (!IsValidFormDataVector(forms))
     return;
 
   if (!driver_->RendererIsAvailable())
     return;
 
   bool enabled = IsAutofillEnabled();
   if (!has_logged_autofill_enabled_) {
     AutofillMetrics::LogIsAutofillEnabledAtPageLoad(enabled);
     has_logged_autofill_enabled_ = true;
   }
 
   if (!enabled)
     return;
 
   for (size_t i = 0; i < forms.size(); ++i) {
     forms_loaded_timestamps_[forms[i]] = timestamp;
   }
 
-  ParseForms(forms);
+  ParseForms(forms, unowned_form_index);
 }
 
 void AutofillManager::OnTextFieldDidChange(const FormData& form,
                                            const FormFieldData& field,
                                            const TimeTicks& timestamp) {
   if (!IsValidFormData(form) || !IsValidFormFieldData(field))
     return;
 
   FormStructure* form_structure = NULL;
   AutofillField* autofill_field = NULL;
@@ skipping 784 matching lines @@
     const AutofillType& type) const {
   std::vector<Suggestion> suggestions =
       personal_data_->GetCreditCardSuggestions(type, field.value);
   for (size_t i = 0; i < suggestions.size(); i++) {
     suggestions[i].frontend_id =
         MakeFrontendID(suggestions[i].backend_id, SuggestionBackendID());
   }
   return suggestions;
 }
 
-void AutofillManager::ParseForms(const std::vector<FormData>& forms) {
+void AutofillManager::ParseForms(const std::vector<FormData>& forms,
+                                 size_t unowned_form_index) {
   std::vector<FormStructure*> non_queryable_forms;
-  for (std::vector<FormData>::const_iterator iter = forms.begin();
-       iter != forms.end(); ++iter) {
-    scoped_ptr<FormStructure> form_structure(new FormStructure(*iter));
+  for (size_t i = 0; i < forms.size(); ++i) {
+    scoped_ptr<FormStructure> form_structure(new FormStructure(forms[i]));
     if (!form_structure->ShouldBeParsed())
       continue;
 
+    if (i == unowned_form_index)
+      form_structure->set_is_unowned();
+
     form_structure->DetermineHeuristicTypes();
 
     if (form_structure->ShouldBeCrowdsourced())
       form_structures_.push_back(form_structure.release());
     else
       non_queryable_forms.push_back(form_structure.release());
   }
 
   if (!form_structures_.empty() && download_manager_) {
     // Query the server if at least one of the forms was parsed.
@@ skipping 93 matching lines @@
     return false;
 
   // Disregard forms that we wouldn't ever autofill in the first place.
   if (!form.ShouldBeParsed())
     return false;
 
   return true;
 }
 
 }  // namespace autofill