Autofill: Set requirements for number of recognized fields in an autofillable form

components/autofill/core/browser/autofill_manager.cc

Index: components/autofill/core/browser/autofill_manager.cc
diff --git a/components/autofill/core/browser/autofill_manager.cc b/components/autofill/core/browser/autofill_manager.cc
index b9123d0674c4f40feaa014629ccaeed59e2d437e..b1dc2dce7bb58255d632bb140cfec8c806261b2b 100644
--- a/components/autofill/core/browser/autofill_manager.cc
+++ b/components/autofill/core/browser/autofill_manager.cc
@@ -386,7 +386,11 @@ bool AutofillManager::OnFormSubmitted(const FormData& form,
 }
 
 void AutofillManager::OnFormsSeen(const std::vector<FormData>& forms,
+                                  size_t unowned_form_index,
                                   const TimeTicks& timestamp) {
+  if (unowned_form_index > forms.size())

[Evan Stade, 2015/01/22 23:43:45]

when does this happen?

[Lei Zhang, 2015/01/22 23:58:13]

It shouldn't, but we can't trust the IPC from the renderer, so we need to check.
Otherwise a compromised renderer can trivially cause out of bound memory access.

[Evan Stade, 2015/01/23 02:21:46]

at least notreached() then? Can you get an IPC owner to confirm this is the
proper way to handle a compromised renderer? (If you follow my advice on
FormData this becomes irrelevant.)

[Lei Zhang, 2015/01/23 06:59:47]

ValidFormDataVector() below doesn't have a NOTREACHED() either, so I'm being
consistent. Another option is to call ReceivedBadMessage() and kill the
renderer. This CL will touch IPC no matter what, so I'll ask when the time
comes.

+    return;
+
   if (!IsValidFormDataVector(forms))
     return;
 
@@ -406,7 +410,7 @@ void AutofillManager::OnFormsSeen(const std::vector<FormData>& forms,
     forms_loaded_timestamps_[forms[i]] = timestamp;
   }
 
-  ParseForms(forms);
+  ParseForms(forms, unowned_form_index);
 }
 
 void AutofillManager::OnTextFieldDidChange(const FormData& form,
@@ -1211,14 +1215,17 @@ std::vector<Suggestion> AutofillManager::GetCreditCardSuggestions(
   return suggestions;
 }
 
-void AutofillManager::ParseForms(const std::vector<FormData>& forms) {
+void AutofillManager::ParseForms(const std::vector<FormData>& forms,
+                                 size_t unowned_form_index) {
   std::vector<FormStructure*> non_queryable_forms;
-  for (std::vector<FormData>::const_iterator iter = forms.begin();
-       iter != forms.end(); ++iter) {
-    scoped_ptr<FormStructure> form_structure(new FormStructure(*iter));
+  for (size_t i = 0; i < forms.size(); ++i) {
+    scoped_ptr<FormStructure> form_structure(new FormStructure(forms[i]));
     if (!form_structure->ShouldBeParsed())
       continue;
 
+    if (i == unowned_form_index)
+      form_structure->set_is_unowned();
+
     form_structure->DetermineHeuristicTypes();
 
     if (form_structure->ShouldBeCrowdsourced())