Merge 49131 - Add rgb_frame size tracking and resizing to fix security issue ...

chrome/browser/renderer_host/backing_store_x.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/renderer_host/backing_store_x.h"
 
 #include <cairo-xlib.h>
 #include <gtk/gtk.h>
 #include <stdlib.h>
 #include <sys/ipc.h>
 #include <sys/shm.h>
 
 #if defined(OS_OPENBSD) || defined(OS_FREEBSD)
 #include <sys/endian.h>
 #endif
 
 #include <algorithm>
 #include <utility>
+#include <limits>
 
 #include "app/surface/transport_dib.h"
 #include "app/x11_util.h"
 #include "app/x11_util_internal.h"
 #include "base/compiler_specific.h"
 #include "base/histogram.h"
 #include "base/logging.h"
 #include "base/time.h"
 #include "chrome/browser/renderer_host/render_process_host.h"
 #include "gfx/rect.h"
 #include "skia/ext/platform_canvas.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 
+// Assume that somewhere along the line, someone will do width * height * 4
+// with signed numbers. If the maximum value is 2**31, then 2**31 / 4 =
+// 2**29 and floor(sqrt(2**29)) = 23170.
+
+// Max height and width for layers
+static const int kMaxVideoLayerSize = 23170;
+
+
 // X Backing Stores:
 //
 // Unlike Windows, where the backing store is kept in heap memory, we keep our
 // backing store in the X server, as a pixmap. Thus expose events just require
 // instructing the X server to copy from the backing store to the window.
 //
 // The backing store is in the same format as the visual which our main window
 // is using. Bitmaps from the renderer are uploaded to the X server, either via
 // shared memory or over the wire, and XRENDER is used to convert them to the
 // correct format for the backing store.
@@ skipping 111 matching lines @@
   *painted_synchronously = true;
 
   if (!display_)
     return;
 
   if (bitmap_rect.IsEmpty())
     return;
 
   const int width = bitmap_rect.width();
   const int height = bitmap_rect.height();
-  // Assume that somewhere along the line, someone will do width * height * 4
-  // with signed numbers. If the maximum value is 2**31, then 2**31 / 4 =
-  // 2**29 and floor(sqrt(2**29)) = 23170.
-  if (width > 23170 || height > 23170)
+
+  if (width <= 0 || width > kMaxVideoLayerSize ||
+      height <= 0 || height > kMaxVideoLayerSize)
     return;
 
   TransportDIB* dib = process->GetTransportDIB(bitmap);
   if (!dib)
     return;
 
   if (!use_render_)
     return PaintRectWithoutXrender(dib, bitmap_rect, copy_rects);
 
   Picture picture;
@@ skipping 110 matching lines @@
   const int height = std::min(size().height(), rect.height());
 
   XImage* image;
   XShmSegmentInfo shminfo;  // Used only when shared memory is enabled.
   if (shared_memory_support_ != x11_util::SHARED_MEMORY_NONE) {
     // Use shared memory for faster copies when it's available.
     Visual* visual = static_cast<Visual*>(visual_);
     memset(&shminfo, 0, sizeof(shminfo));
     image = XShmCreateImage(display_, visual, 32,
                             ZPixmap, NULL, &shminfo, width, height);
-
+    if (!image) {
+      return false;
+    }
     // Create the shared memory segment for the image and map it.
+    if (image->bytes_per_line == 0 || image->height == 0 ||
+        (std::numeric_limits<size_t>::max() / image->bytes_per_line) >
+        static_cast<size_t>(image->height)) {
+      XDestroyImage(image);
+      return false;
+    }
     shminfo.shmid = shmget(IPC_PRIVATE, image->bytes_per_line * image->height,
                            IPC_CREAT|0666);
     if (shminfo.shmid == -1) {
       XDestroyImage(image);
       return false;
     }
 
     void* mapped_memory = shmat(shminfo.shmid, NULL, SHM_RDONLY);
     shmctl(shminfo.shmid, IPC_RMID, 0);
     if (mapped_memory == (void*)-1) {
@@ skipping 118 matching lines @@
   cairo_set_source(cr, pattern);
   cairo_pattern_destroy(pattern);
 
   cairo_identity_matrix(cr);
 
   cairo_rectangle(cr, rect.x(), rect.y(), rect.width(), rect.height());
   cairo_fill(cr);
   cairo_destroy(cr);
 }
 #endif