From 544895299e2e23d4832b50703fe37dbbfb6a5b88 Mon Sep 17 00:00:00 2001
From: Alexei Svitkine <asvitkine@chromium.org>
Date: Fri, 05 Jun 2026 14:09:17 -0700
Subject: [PATCH] Validate histogram type after deserialization.

In HistogramBase::DeserializeInfo, check if the type of the deserialized
histogram matches the expected type. This prevents returning a
DummyHistogram when deserialization fails due to invalid arguments.

Bug: 520189702
Change-Id: Ic60769ec0390187c6a82356f99c490a89e768e58
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7902851
Reviewed-by: Luc Nguyen <lucnguyen@google.com>
Commit-Queue: Luc Nguyen <lucnguyen@google.com>
Commit-Queue: Alexei Svitkine <asvitkine@chromium.org>
Auto-Submit: Alexei Svitkine <asvitkine@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1642586}
---

diff --git a/base/metrics/histogram_base.cc b/base/metrics/histogram_base.cc
index a24940a..684cf71d 100644
--- a/base/metrics/histogram_base.cc
+++ b/base/metrics/histogram_base.cc
@@ -72,20 +72,35 @@
     return nullptr;
   }
 
+  HistogramBase* result;
   switch (type) {
     case HISTOGRAM:
-      return Histogram::DeserializeInfoImpl(iter, mapper);
+      result = Histogram::DeserializeInfoImpl(iter, mapper);
+      break;
     case LINEAR_HISTOGRAM:
-      return LinearHistogram::DeserializeInfoImpl(iter, mapper);
+      result = LinearHistogram::DeserializeInfoImpl(iter, mapper);
+      break;
     case BOOLEAN_HISTOGRAM:
-      return BooleanHistogram::DeserializeInfoImpl(iter, mapper);
+      result = BooleanHistogram::DeserializeInfoImpl(iter, mapper);
+      break;
     case CUSTOM_HISTOGRAM:
-      return CustomHistogram::DeserializeInfoImpl(iter, mapper);
+      result = CustomHistogram::DeserializeInfoImpl(iter, mapper);
+      break;
     case SPARSE_HISTOGRAM:
-      return SparseHistogram::DeserializeInfoImpl(iter, mapper);
+      result = SparseHistogram::DeserializeInfoImpl(iter, mapper);
+      break;
     default:
       return nullptr;
   }
+
+  if (result != nullptr &&
+      result->GetHistogramType() != static_cast<HistogramType>(type)) {
+    // If there's a type mismatch, this could be a DummyHistogram returned by
+    // FactoryGetInternal() due to invalid arguments. In this case, return
+    // nullptr to indicate an error.
+    return nullptr;
+  }
+  return result;
 }
 
 HistogramBase::HistogramBase(DurableStringView name)
diff --git a/base/metrics/histogram_base_unittest.cc b/base/metrics/histogram_base_unittest.cc
index dc88844..73b2071 100644
--- a/base/metrics/histogram_base_unittest.cc
+++ b/base/metrics/histogram_base_unittest.cc
@@ -248,4 +248,62 @@
   EXPECT_EQ(add_count, samples->GetCount(0));
 }
 
+TEST_F(HistogramBaseTest, DeserializeTypeMismatch) {
+  // Create a LinearHistogram and register it in the StatisticsRecorder.
+  HistogramBase* histogram = LinearHistogram::FactoryGet(
+      "TestMismatchedHistogram", 1, 1000, 10, HistogramBase::kNoFlags);
+  Pickle real_pickle;
+  histogram->SerializeInfo(&real_pickle);
+
+  // Read the serialized fields using a PickleIterator.
+  int type;
+  std::string name;
+  int flags;
+  int declared_min;
+  int declared_max;
+  uint32_t bucket_count;
+  uint32_t range_checksum;
+
+  PickleIterator iter(real_pickle);
+  ASSERT_TRUE(iter.ReadInt(&type));
+  ASSERT_TRUE(iter.ReadString(&name));
+  ASSERT_TRUE(iter.ReadInt(&flags));
+  ASSERT_TRUE(iter.ReadInt(&declared_min));
+  ASSERT_TRUE(iter.ReadInt(&declared_max));
+  ASSERT_TRUE(iter.ReadUInt32(&bucket_count));
+  ASSERT_TRUE(iter.ReadUInt32(&range_checksum));
+
+  EXPECT_EQ(LINEAR_HISTOGRAM, type);
+
+  // Verify that deserializing the unmodified base pickle succeeds.
+  PickleIterator real_iter(real_pickle);
+  HistogramBase* deserialized_real =
+      HistogramBase::DeserializeInfo(&real_iter, base::NullCallback());
+  EXPECT_EQ(histogram, deserialized_real);
+  // And that it succeeds a second time too.
+  PickleIterator real_iter2(real_pickle);
+  HistogramBase* deserialized_real2 =
+      HistogramBase::DeserializeInfo(&real_iter2, base::NullCallback());
+  EXPECT_EQ(histogram, deserialized_real2);
+
+  // Construct a modified pickle claiming the type is HISTOGRAM instead of
+  // LINEAR_HISTOGRAM.
+  Pickle mismatched_pickle;
+  mismatched_pickle.WriteInt(HISTOGRAM);  // Mismatched type!
+  mismatched_pickle.WriteString(name);
+  mismatched_pickle.WriteInt(flags);
+  mismatched_pickle.WriteInt(declared_min);
+  mismatched_pickle.WriteInt(declared_max);
+  mismatched_pickle.WriteUInt32(bucket_count);
+  mismatched_pickle.WriteUInt32(range_checksum);
+
+  // Deserialize the mismatched pickle. Because "TestMismatchedHistogram"
+  // is already registered as a LINEAR_HISTOGRAM, looking it up as a
+  // HISTOGRAM should detect the type mismatch and return nullptr.
+  PickleIterator mismatched_iter(mismatched_pickle);
+  HistogramBase* deserialized =
+      HistogramBase::DeserializeInfo(&mismatched_iter, base::NullCallback());
+  EXPECT_FALSE(deserialized);
+}
+
 }  // namespace base

diff --git a/base/metrics/histogram_base_unittest.cc b/base/metrics/histogram_base_unittest.cc
index dc88844..73b2071 100644
--- a/base/metrics/histogram_base_unittest.cc
+++ b/base/metrics/histogram_base_unittest.cc
@@ -248,4 +248,62 @@
   EXPECT_EQ(add_count, samples->GetCount(0));
 }
 
+TEST_F(HistogramBaseTest, DeserializeTypeMismatch) {
+  // Create a LinearHistogram and register it in the StatisticsRecorder.
+  HistogramBase* histogram = LinearHistogram::FactoryGet(
+      "TestMismatchedHistogram", 1, 1000, 10, HistogramBase::kNoFlags);
+  Pickle real_pickle;
+  histogram->SerializeInfo(&real_pickle);
+
+  // Read the serialized fields using a PickleIterator.
+  int type;
+  std::string name;
+  int flags;
+  int declared_min;
+  int declared_max;
+  uint32_t bucket_count;
+  uint32_t range_checksum;
+
+  PickleIterator iter(real_pickle);
+  ASSERT_TRUE(iter.ReadInt(&type));
+  ASSERT_TRUE(iter.ReadString(&name));
+  ASSERT_TRUE(iter.ReadInt(&flags));
+  ASSERT_TRUE(iter.ReadInt(&declared_min));
+  ASSERT_TRUE(iter.ReadInt(&declared_max));
+  ASSERT_TRUE(iter.ReadUInt32(&bucket_count));
+  ASSERT_TRUE(iter.ReadUInt32(&range_checksum));
+
+  EXPECT_EQ(LINEAR_HISTOGRAM, type);
+
+  // Verify that deserializing the unmodified base pickle succeeds.
+  PickleIterator real_iter(real_pickle);
+  HistogramBase* deserialized_real =
+      HistogramBase::DeserializeInfo(&real_iter, base::NullCallback());
+  EXPECT_EQ(histogram, deserialized_real);
+  // And that it succeeds a second time too.
+  PickleIterator real_iter2(real_pickle);
+  HistogramBase* deserialized_real2 =
+      HistogramBase::DeserializeInfo(&real_iter2, base::NullCallback());
+  EXPECT_EQ(histogram, deserialized_real2);
+
+  // Construct a modified pickle claiming the type is HISTOGRAM instead of
+  // LINEAR_HISTOGRAM.
+  Pickle mismatched_pickle;
+  mismatched_pickle.WriteInt(HISTOGRAM);  // Mismatched type!
+  mismatched_pickle.WriteString(name);
+  mismatched_pickle.WriteInt(flags);
+  mismatched_pickle.WriteInt(declared_min);
+  mismatched_pickle.WriteInt(declared_max);
+  mismatched_pickle.WriteUInt32(bucket_count);
+  mismatched_pickle.WriteUInt32(range_checksum);
+
+  // Deserialize the mismatched pickle. Because "TestMismatchedHistogram"
+  // is already registered as a LINEAR_HISTOGRAM, looking it up as a
+  // HISTOGRAM should detect the type mismatch and return nullptr.
+  PickleIterator mismatched_iter(mismatched_pickle);
+  HistogramBase* deserialized =
+      HistogramBase::DeserializeInfo(&mismatched_iter, base::NullCallback());
+  EXPECT_FALSE(deserialized);
+}
+
 }  // namespace base