2 files changed, 20 insertions, 3 deletions
diff --git a/chrome/browser/process_info_snapshot.h b/chrome/browser/process_info_snapshot.h
index 88064c6..14e8ceb 100644
--- a/chrome/browser/process_info_snapshot.h
+++ b/chrome/browser/process_info_snapshot.h
@@ -31,9 +31,14 @@ class ProcessInfoSnapshot {
   ProcessInfoSnapshot();
   ~ProcessInfoSnapshot();
 
+  // Maximum size of lists of PIDs which this class will accept; used in
+  // |Sample()| below.
+  static const size_t kMaxPidListSize;
+
   // Capture a snapshot of process memory information (by running ps) for the
   // given list of PIDs. Call only from the file thread.
-  //   |pid_list| - list of |ProcessId|s on which to capture information.
+  //   |pid_list| - list of |ProcessId|s on which to capture information; must
+  //     have no more than |kMaxPidListSize| (above) entries,
   //   returns - |true| if okay, |false| on error.
   bool Sample(std::vector<base::ProcessId> pid_list);
 
diff --git a/chrome/browser/process_info_snapshot_mac.cc b/chrome/browser/process_info_snapshot_mac.cc
index 611f8f4..4e2608b 100644
--- a/chrome/browser/process_info_snapshot_mac.cc
+++ b/chrome/browser/process_info_snapshot_mac.cc
@@ -7,6 +7,7 @@
 #include <iostream>
 #include <sstream>
 
+#include "base/logging.h"
 #include "base/string_util.h"
 #include "base/thread.h"
 
@@ -21,6 +22,8 @@ ProcessInfoSnapshot::~ProcessInfoSnapshot() {
   Reset();
 }
 
+const size_t ProcessInfoSnapshot::kMaxPidListSize = 1000;
+
 // Capture the information by calling '/bin/ps'.
 // Note: we ignore the "tsiz" (text size) display option of ps because it's
 // always zero (tested on 10.5 and 10.6).
@@ -28,6 +31,15 @@ bool ProcessInfoSnapshot::Sample(std::vector<base::ProcessId> pid_list) {
   const char* kPsPathName = "/bin/ps";
   Reset();
 
+  // Nothing to do if no PIDs given.
+  if (pid_list.size() == 0)
+    return true;
+  if (pid_list.size() > kMaxPidListSize) {
+    // The spec says |pid_list| *must* not have more than this many entries.
+    NOTREACHED();
+    return false;
+  }
+
   std::vector<std::string> argv;
   argv.push_back(kPsPathName);
   // Get PID, PPID, (real) UID, effective UID, resident set size, virtual memory
@@ -43,8 +55,8 @@ bool ProcessInfoSnapshot::Sample(std::vector<base::ProcessId> pid_list) {
 
   std::string output;
   CommandLine command_line(argv);
-  if (!base::GetAppOutputRestricted(command_line,
-                                    &output, (pid_list.size() + 10) * 100)) {
+  // Limit output read to a megabyte for safety.
+  if (!base::GetAppOutputRestricted(command_line, &output, 1024 * 1024)) {
     LOG(ERROR) << "Failure running " << kPsPathName << " to acquire data.";
     return false;
   }