MidiManagerUsb should not trust indices provided by renderer.

media/midi/midi_manager_usb.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/midi/midi_manager_usb.h"
 
 #include "base/callback.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/message_loop/message_loop.h"
@@ skipping 25 matching lines @@
   device_factory_->EnumerateDevices(
       this,
       base::Bind(&MidiManagerUsb::OnEnumerateDevicesDone,
                  base::Unretained(this)));
 }
 
 void MidiManagerUsb::DispatchSendMidiData(MidiManagerClient* client,
                                           uint32_t port_index,
                                           const std::vector<uint8>& data,
                                           double timestamp) {
-  DCHECK_LT(port_index, output_streams_.size());
+  if (port_index >= output_streams_.size()) {

[Takashi Toyoshima, 2015/02/09 06:34:41]

Can you add TODO(toyoshim) here?
I think we should check this in MidiHost, and call BadMessageReceived() to kill
the malicious renderer. But for now, MidiHost does not have information about
the max port number. So this change looks ok now.

[yhirano, 2015/02/09 08:41:12]

Done.

+    // |port_index| is provided by a renderer so we can't believe that it is
+    // in the valid range.
+    return;
+  }
   output_streams_[port_index]->Send(data);
   client->AccumulateMidiBytesSent(data.size());
 }
 
 void MidiManagerUsb::ReceiveUsbMidiData(UsbMidiDevice* device,
                                         int endpoint_number,
                                         const uint8* data,
                                         size_t size,
                                         base::TimeTicks time) {
   if (!input_stream_)
@@ skipping 57 matching lines @@
                                      static_cast<long>(j));
         AddInputPort(port);
       }
     }
     input_stream_.reset(new UsbMidiInputStream(input_jacks, this));
   }
   initialize_callback_.Run(MIDI_OK);
 }
 
 }  // namespace media