Validate debuggee.targetId before use in chrome.debugger

chrome/browser/extensions/api/debugger/debugger_api.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Implements the Chrome Extensions Debugger API.
 
 #include "chrome/browser/extensions/api/debugger/debugger_api.h"
 
 #include <map>
 #include <set>
@@ skipping 511 matching lines @@
                                            extension_host->GetURL(),
                                            extension(),
                                            &error_)) {
         return false;
       }
       agent_host_ =
           DevToolsAgentHost::GetOrCreateFor(extension_host->host_contents());
     }
   } else if (debuggee_.target_id) {
     agent_host_ = DevToolsAgentHost::GetForId(*debuggee_.target_id);
+    if (agent_host_.get()) {
+      if (PermissionsData::IsRestrictedUrl(agent_host_->GetURL(),
+                                           agent_host_->GetURL(),
+                                           extension(),
+                                           &error_)) {
+        agent_host_ = nullptr;
+        return false;
+      }
+    }
   } else {
     error_ = keys::kInvalidTargetError;
     return false;
   }
 
   if (!agent_host_.get()) {
     FormatErrorMessage(keys::kNoTargetError);
     return false;
   }
   return true;
@@ skipping 192 matching lines @@
     const std::vector<DevToolsTargetImpl*>& target_list) {
   scoped_ptr<base::ListValue> result(new base::ListValue());
   for (size_t i = 0; i < target_list.size(); ++i)
     result->Append(SerializeTarget(*target_list[i]));
   STLDeleteContainerPointers(target_list.begin(), target_list.end());
   SetResult(result.release());
   SendResponse(true);
 }
 
 }  // namespace extensions