MidiManagerUsb should not trust indices provided by renderer.

media/midi/midi_manager_usb_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/midi/midi_manager_usb.h"
 
 #include <string>
 
 #include "base/message_loop/message_loop.h"
 #include "base/run_loop.h"
@@ skipping 298 matching lines @@
   manager_->DispatchSendMidiData(&client, 1, ToVector(data), 0);
   EXPECT_EQ("UsbMidiDevice::GetDescriptor\n"
             "UsbMidiDevice::Send endpoint = 2 data = "
             "0x19 0x90 0x45 0x7f "
             "0x14 0xf0 0x00 0x01 "
             "0x15 0xf7 0x00 0x00\n"
             "MidiManagerClient::AccumulateMidiBytesSent size = 7\n",
             logger_.TakeLog());
 }
 
+TEST_F(MidiManagerUsbTest, SendFromCompromizedRenderer) {
+  scoped_ptr<FakeUsbMidiDevice> device(new FakeUsbMidiDevice(&logger_));
+  FakeMidiManagerClient client(&logger_);
+  uint8 descriptor[] = {
+    0x12, 0x01, 0x10, 0x01, 0x00, 0x00, 0x00, 0x08, 0x86, 0x1a,
+    0x2d, 0x75, 0x54, 0x02, 0x00, 0x02, 0x00, 0x01, 0x09, 0x02,
+    0x75, 0x00, 0x02, 0x01, 0x00, 0x80, 0x30, 0x09, 0x04, 0x00,
+    0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x09, 0x24, 0x01, 0x00,
+    0x01, 0x09, 0x00, 0x01, 0x01, 0x09, 0x04, 0x01, 0x00, 0x02,
+    0x01, 0x03, 0x00, 0x00, 0x07, 0x24, 0x01, 0x00, 0x01, 0x51,
+    0x00, 0x06, 0x24, 0x02, 0x01, 0x02, 0x00, 0x06, 0x24, 0x02,
+    0x01, 0x03, 0x00, 0x06, 0x24, 0x02, 0x02, 0x06, 0x00, 0x09,
+    0x24, 0x03, 0x01, 0x07, 0x01, 0x06, 0x01, 0x00, 0x09, 0x24,
+    0x03, 0x02, 0x04, 0x01, 0x02, 0x01, 0x00, 0x09, 0x24, 0x03,
+    0x02, 0x05, 0x01, 0x03, 0x01, 0x00, 0x09, 0x05, 0x02, 0x02,
+    0x20, 0x00, 0x00, 0x00, 0x00, 0x06, 0x25, 0x01, 0x02, 0x02,
+    0x03, 0x09, 0x05, 0x82, 0x02, 0x20, 0x00, 0x00, 0x00, 0x00,
+    0x05, 0x25, 0x01, 0x01, 0x07,
+  };
+
+  device->SetDescriptor(ToVector(descriptor));
+  uint8 data[] = {
+    0x90, 0x45, 0x7f,
+    0xf0, 0x00, 0x01, 0xf7,
+  };
+
+  Initialize();
+  ScopedVector<UsbMidiDevice> devices;
+  devices.push_back(device.release());
+  EXPECT_FALSE(IsInitializationCallbackInvoked());
+  RunCallbackUntilCallbackInvoked(true, &devices);
+  EXPECT_EQ(MIDI_OK, GetInitializationResult());
+  ASSERT_EQ(2u, manager_->output_streams().size());
+  EXPECT_EQ("UsbMidiDevice::GetDescriptor\n", logger_.TakeLog());
+
+  // The specified port index is invalid. The manager must ignore the request.
+  manager_->DispatchSendMidiData(&client, 99, ToVector(data), 0);
+  EXPECT_EQ("", logger_.TakeLog());
+
+  // The specified port index is invalid. The manager must ignore the request.
+  manager_->DispatchSendMidiData(&client, 2, ToVector(data), 0);
+  EXPECT_EQ("", logger_.TakeLog());
+}
+
 TEST_F(MidiManagerUsbTest, Receive) {
   scoped_ptr<FakeUsbMidiDevice> device(new FakeUsbMidiDevice(&logger_));
   uint8 descriptor[] = {
     0x12, 0x01, 0x10, 0x01, 0x00, 0x00, 0x00, 0x08, 0x86, 0x1a,
     0x2d, 0x75, 0x54, 0x02, 0x00, 0x02, 0x00, 0x01, 0x09, 0x02,
     0x75, 0x00, 0x02, 0x01, 0x00, 0x80, 0x30, 0x09, 0x04, 0x00,
     0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x09, 0x24, 0x01, 0x00,
     0x01, 0x09, 0x00, 0x01, 0x01, 0x09, 0x04, 0x01, 0x00, 0x02,
     0x01, 0x03, 0x00, 0x00, 0x07, 0x24, 0x01, 0x00, 0x01, 0x51,
     0x00, 0x06, 0x24, 0x02, 0x01, 0x02, 0x00, 0x06, 0x24, 0x02,
@@ skipping 31 matching lines @@
             "data = 0x90 0x45 0x7f\n"
             "MidiManagerClient::ReceiveMidiData port_index = 0 "
             "data = 0xf0 0x00 0x01\n"
             "MidiManagerClient::ReceiveMidiData port_index = 0 data = 0xf7\n",
             logger_.TakeLog());
 }
 
 }  // namespace
 
 }  // namespace media