Commit message: None
CVE: CVE-2013-6640
CWE: CWE-119
Vulnerability description: The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service (out-of-bounds read) via JavaScript code that sets a variable to the value of an array element with a crafted index.

Project: Chrome

AffiliationFetcher::AffiliationFetcher(
    net::URLRequestContextGetter* request_context_getter,
    const std::vector<FacetURI>& facet_uris,
    AffiliationFetcherDelegate* delegate)
    : request_context_getter_(request_context_getter),
      requested_facet_uris_(facet_uris),
      delegate_(delegate) {
  for (const FacetURI& uri : requested_facet_uris_) {
    DCHECK(uri.is_valid());
  }
}

Project: Chrome

GURL AffiliationFetcher::BuildQueryURL() const {
  return net::AppendQueryParameter(
      GURL("https://www.googleapis.com/affiliation/v1/affiliation:lookup"),
      "key", google_apis::GetAPIKey());
}

Project: Chrome

void AffiliationFetcher::OnURLFetchComplete(const net::URLFetcher* source) {
  DCHECK_EQ(source, fetcher_.get());

  scoped_ptr<AffiliationFetcherDelegate::Result> result(
      new AffiliationFetcherDelegate::Result);
  if (fetcher_->GetStatus().status() == net::URLRequestStatus::SUCCESS &&
      fetcher_->GetResponseCode() == net::HTTP_OK) {
    if (ParseResponse(result.get()))
      delegate_->OnFetchSucceeded(result.Pass());
    else
      delegate_->OnMalformedResponse();
  } else {
    delegate_->OnFetchFailed();
  }
}

Project: Chrome

std::string AffiliationFetcher::PreparePayload() const {
  affiliation_pb::LookupAffiliationRequest lookup_request;
  for (const FacetURI& uri : requested_facet_uris_)
    lookup_request.add_facet(uri.canonical_spec());

  std::string serialized_request;
  bool success = lookup_request.SerializeToString(&serialized_request);
  DCHECK(success);
  return serialized_request;
}

Project: Chrome

void AffiliationFetcher::SetFactoryForTesting(
    TestAffiliationFetcherFactory* factory) {
  g_testing_factory = factory;
}

Project: Chrome

void AffiliationFetcher::StartRequest() {
  DCHECK(!fetcher_);

  fetcher_.reset(
      net::URLFetcher::Create(BuildQueryURL(), net::URLFetcher::POST, this));
  fetcher_->SetRequestContext(request_context_getter_.get());
  fetcher_->SetUploadData("application/x-protobuf", PreparePayload());
  fetcher_->SetLoadFlags(net::LOAD_DO_NOT_SAVE_COOKIES |
                         net::LOAD_DO_NOT_SEND_COOKIES |
                         net::LOAD_DO_NOT_SEND_AUTH_DATA |
                         net::LOAD_BYPASS_CACHE | net::LOAD_DISABLE_CACHE);
  fetcher_->SetAutomaticallyRetryOn5xx(false);
  fetcher_->SetAutomaticallyRetryOnNetworkChanges(0);
  fetcher_->Start();
}

Project: Chrome

  AffiliationFetcherTest()
      : request_context_getter_(new net::TestURLRequestContextGetter(
            make_scoped_refptr(new base::NullTaskRunner))) {}

Project: Chrome

  MockAffiliationFetcherDelegate() {}

Project: Chrome

  void ServiceURLRequest(const std::string& response) {
    net::TestURLFetcher* url_fetcher =
        test_url_fetcher_factory_.GetFetcherByID(0);
    ASSERT_NE(nullptr, url_fetcher);

    url_fetcher->set_response_code(200);
    url_fetcher->SetResponseString(response);
    url_fetcher->delegate()->OnURLFetchComplete(url_fetcher);
  }

Project: Chrome

  void SimulateNetworkError() {
    net::TestURLFetcher* url_fetcher =
        test_url_fetcher_factory_.GetFetcherByID(0);
    ASSERT_NE(nullptr, url_fetcher);
    url_fetcher->set_status(net::URLRequestStatus(net::URLRequestStatus::FAILED,
                                                  net::ERR_NETWORK_CHANGED));
    url_fetcher->delegate()->OnURLFetchComplete(url_fetcher);
  }

Project: Chrome

  void SimulateServerError() {
    net::TestURLFetcher* url_fetcher =
        test_url_fetcher_factory_.GetFetcherByID(0);
    ASSERT_NE(nullptr, url_fetcher);

    url_fetcher->set_response_code(500);
    url_fetcher->delegate()->OnURLFetchComplete(url_fetcher);
  }

Project: Chrome

  void VerifyRequestPayload(const std::vector<FacetURI>& expected_facet_uris) {
    net::TestURLFetcher* url_fetcher =
        test_url_fetcher_factory_.GetFetcherByID(0);
    ASSERT_NE(nullptr, url_fetcher);

    affiliation_pb::LookupAffiliationRequest request;
    ASSERT_TRUE(request.ParseFromString(url_fetcher->upload_data()));

    std::vector<FacetURI> actual_uris;
    for (int i = 0; i < request.facet_size(); ++i)
      actual_uris.push_back(FacetURI::FromCanonicalSpec(request.facet(i)));

    EXPECT_EQ("application/x-protobuf", url_fetcher->upload_content_type());
    EXPECT_THAT(actual_uris,
                testing::UnorderedElementsAreArray(expected_facet_uris));
  }

Project: Chrome

  net::TestURLRequestContextGetter* request_context_getter() {
    return request_context_getter_.get();
  }

Project: Chrome

  const Result& result() const { return *result_.get(); }

Project: Chrome

  ~MockAffiliationFetcherDelegate() {}