Bug 2066736 - Validate filter array lengths in FilePickerParent::RecvOpen. r=dom-core-reviewers,smaug

The loop in RecvOpen counts with aFilters.Length() but reads
aFilterNames[i]. If a content process sends the message with more filters
than filterNames, the read goes out of bounds and the parent process
crashes. So I added a check that both arrays have the same length.

Differential Revision: https://phabricator.services.mozilla.com/D321511

dom/ipc/FilePickerParent.cpp

@@ -280,6 +280,10 @@ mozilla::ipc::IPCResult FilePickerParent::RecvOpen(
     return IPC_OK();
   }
 
+  if (aFilters.Length() != aFilterNames.Length()) {
+    return IPC_FAIL(this, "PFilePicker::Open filter arrays lengths mismatch");
+  }
+
   mFilePicker->SetAddToRecentDocs(aAddToRecentDocs);
 
   for (uint32_t i = 0; i < aFilters.Length(); ++i) {