(Copy of previous CL that existed in a client I lost)

- Don't treat the body of an "authentication required" response as a valid dictionary!
- In the event of a 200 status code, check the response actually looks like a dictionary.

BUG=24486
TEST=Verified the appearance of new dictionaries after changing spell-check language; verified spell-checking on new dictionaries.
TBR=sidchat

Review URL: http://codereview.chromium.org/295014

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@29471 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 10 insertions, 3 deletions

diff --git a/chrome/browser/spellchecker.cc b/chrome/browser/spellchecker.cc
index 6df9c7e..51c9a7d 100644
--- a/chrome/browser/spellchecker.cc
+++ b/chrome/browser/spellchecker.cc
@@ -536,9 +536,16 @@ void SpellChecker::OnURLFetchComplete(const URLFetcher* source,
                                       const ResponseCookies& cookies,
                                       const std::string& data) {
   DCHECK(source);
-  if (!((response_code / 100) == 2 ||
-      response_code == 401 ||
-      response_code == 407)) {
+  if ((response_code / 100) != 2) {
+    obtaining_dictionary_ = false;
+    return;
+  }
+
+  // Basic sanity check on the dictionary.
+  // There's the small chance that we might see a 200 status code for a body
+  // that represents some form of failure.
+  if (data.size() < 4 || data[0] != 'B' || data[1] != 'D' || data[2] != 'i' ||
+      data[3] != 'c') {
     obtaining_dictionary_ = false;
     return;
   }