Fixed memory overflow caused by invalid input.

BUG=95548,296887

Review URL: https://codereview.chromium.org/25651002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@226545 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 18 insertions, 2 deletions

diff --git a/printing/page_range.cc b/printing/page_range.cc
index 7a8cb84..ea2e30a 100644
--- a/printing/page_range.cc
+++ b/printing/page_range.cc
@@ -5,18 +5,24 @@
 #include "printing/page_range.h"
 
 #include <set>
-#include <vector>
+
+namespace {
+const std::size_t kMaxNumberOfPages = 100000;
+}
 
 namespace printing {
 
 /* static */
 std::vector<int> PageRange::GetPages(const PageRanges& ranges) {
+  // TODO(vitalybuka): crbug.com/95548 Remove this method as part fix.
   std::set<int> pages;
   for (unsigned i = 0; i < ranges.size(); ++i) {
     const PageRange& range = ranges[i];
     // Ranges are inclusive.
     for (int i = range.from; i <= range.to; ++i) {
       pages.insert(i);
+      if (pages.size() >= kMaxNumberOfPages)
+        return std::vector<int>(pages.begin(), pages.end());
     }
   }
   return std::vector<int>(pages.begin(), pages.end());
diff --git a/printing/page_range_unittest.cc b/printing/page_range_unittest.cc
index 7b0f577..5370e97 100644
--- a/printing/page_range_unittest.cc
+++ b/printing/page_range_unittest.cc
@@ -32,5 +32,15 @@ TEST(PageRangeTest, RangeMerge) {
 TEST(PageRangeTest, Empty) {
   printing::PageRanges ranges;
   std::vector<int> pages(printing::PageRange::GetPages(ranges));
-  EXPECT_EQ(0U, pages.size());
+  EXPECT_TRUE(pages.empty());
+}
+
+TEST(PageRangeTest, Huge) {
+  printing::PageRanges ranges;
+  printing::PageRange range;
+  range.from = 1;
+  range.to = 2000000000;
+  ranges.push_back(range);
+  std::vector<int> pages(printing::PageRange::GetPages(ranges));
+  EXPECT_FALSE(pages.empty());
 }