diff options
| author | mpcomplete@chromium.org <mpcomplete@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2009-10-12 17:21:53 +0000 |
|---|---|---|
| committer | mpcomplete@chromium.org <mpcomplete@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2009-10-12 17:21:53 +0000 |
| commit | 45c4a0721e38e96fa94677c7accd8fd53a77fd86 (patch) | |
| tree | 1d2df12092750d8b5e2fb2c7ffc04df4f38b2798 /chrome/browser/extensions | |
| parent | cfaa1f2938c346d4801b895e7181f5de7d3755e6 (diff) | |
| download | chromium_src-45c4a0721e38e96fa94677c7accd8fd53a77fd86.zip chromium_src-45c4a0721e38e96fa94677c7accd8fd53a77fd86.tar.gz chromium_src-45c4a0721e38e96fa94677c7accd8fd53a77fd86.tar.bz2 | |
Fix a browser crash when calling browserAction.setIcon(invalidIndex).
BUG=24354
TEST=Load the test_browser_action extension and click on the button a few times. It should cycle between a printer and animating shapes without crashing.
Review URL: http://codereview.chromium.org/261049
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@28712 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'chrome/browser/extensions')
| -rw-r--r-- | chrome/browser/extensions/extension_browser_actions_api.cc | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/chrome/browser/extensions/extension_browser_actions_api.cc b/chrome/browser/extensions/extension_browser_actions_api.cc index 2a3aa2e2..75ec089 100644 --- a/chrome/browser/extensions/extension_browser_actions_api.cc +++ b/chrome/browser/extensions/extension_browser_actions_api.cc @@ -23,6 +23,8 @@ namespace { // Errors. const char kNoBrowserActionError[] = "This extension has no browser action specified."; +const char kIconIndexOutOfBounds[] = + "Browser action icon index out of bounds."; } bool BrowserActionSetNameFunction::RunImpl() { @@ -67,7 +69,15 @@ bool BrowserActionSetIconFunction::RunImpl() { } else { int icon_index = -1; EXTENSION_FUNCTION_VALIDATE(args_->GetAsInteger(&icon_index)); + + if (icon_index < 0 || + static_cast<size_t>(icon_index) >= + extension->browser_action()->icon_paths().size()) { + error_ = kIconIndexOutOfBounds; + return false; + } extension->browser_action_state()->set_icon_index(icon_index); + extension->browser_action_state()->set_icon(NULL); } NotificationService::current()->Notify( |