GPUProcessor uses O3D command buffer service to render to a window....

o3d/gpu_plugin/command_buffer.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "o3d/gpu_plugin/command_buffer.h"
 
 namespace o3d {
 namespace gpu_plugin {
 
 CommandBuffer::CommandBuffer(NPP npp)
     : npp_(npp),
       size_(0),
       get_offset_(0),
       put_offset_(0),
       token_(0),
-      error_(ERROR_NO_ERROR) {
+      parse_error_(0),
+      error_status_(false) {
   // Element zero is always NULL.
   registered_objects_.push_back(NPObjectPointer<NPObject>());
 }
 
 CommandBuffer::~CommandBuffer() {
 }
 
 bool CommandBuffer::Initialize(int32 size) {
+  // Check the size will not overflow when it is converted from count of int32s
+  // to count of bytes.
+  int32 num_bytes =  static_cast<int32>(size * sizeof(int32));
+  if (num_bytes / sizeof(int32) != size)
+    return false;
+
   if (shared_memory_.Get())
     return false;
 
   NPObjectPointer<NPObject> window = NPObjectPointer<NPObject>::FromReturned(
       NPBrowser::get()->GetWindowNPObject(npp_));
   if (!window.Get())
     return false;
 
   NPObjectPointer<NPObject> chromium;
   if (!NPGetProperty(npp_, window, "chromium", &chromium)) {
     return false;
   }
 
   NPObjectPointer<NPObject> system;
   if (!NPGetProperty(npp_, chromium, "system", &system)) {
     return false;
   }
 
   NPObjectPointer<NPObject> result;
-  if (!NPInvoke(npp_, system, "createSharedMemory", size,
+  if (!NPInvoke(npp_, system, "createSharedMemory", num_bytes,
                 &result)) {
     return false;
   }
 
   // TODO(spatrick): validate NPClass before assuming a CHRSharedMemory is
   //    returned.
   shared_memory_ = NPObjectPointer<CHRSharedMemory>(
       static_cast<CHRSharedMemory*>(result.Get()));
   if (!shared_memory_.Get())
     return false;
@@ skipping 86 matching lines @@
   // to shrink when, for example, all objects are unregistered. Note that this
   // loop never removes element zero, which is always NULL.
   while (registered_objects_.size() > 1 && !registered_objects_.back().Get()) {
     registered_objects_.pop_back();
     unused_registered_object_elements_.erase(
         static_cast<int32>(registered_objects_.size()));
   }
 }
 
 NPObjectPointer<NPObject> CommandBuffer::GetRegisteredObject(int32 handle) {
-  DCHECK_GE(handle, 0);
-  DCHECK_LT(static_cast<size_t>(handle), registered_objects_.size());
+  if (handle < 0)
+    return NPObjectPointer<NPObject>();
+
+  if (static_cast<size_t>(handle) >= registered_objects_.size())
+    return NPObjectPointer<NPObject>();
 
   return registered_objects_[handle];
 }
 
-int32 CommandBuffer::ResetError() {
-  int32 last_error = error_;
-  error_ = ERROR_NO_ERROR;
+int32 CommandBuffer::ResetParseError() {
+  int32 last_error = parse_error_;
+  parse_error_ = 0;
   return last_error;
 }
 
 }  // namespace gpu_plugin
 }  // namespace o3d