Fix memory problem in DecoderVerbatim

remoting/base/decoder_verbatim.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "remoting/base/decoder_verbatim.h"
 
 #include "remoting/base/protocol_util.h"
 
 namespace remoting {
 
@@ skipping 84 matching lines @@
 }
 
 bool DecoderVerbatim::HandleRectData(ChromotingHostMessage* message) {
   DCHECK_EQ(kWaitingForRectData, state_);
   DCHECK_EQ(0,
             message->update_stream_packet().rect_data().sequence_number());
 
   // Copy the data line by line.
   const int src_stride = bytes_per_pixel_ * rect_width_;
   const char* src =
-      message->update_stream_packet().rect_data().data().c_str();
+      message->update_stream_packet().rect_data().data().data();
+
+  // Make sure there's enough data in |message|.
+  const int src_size =
+      message->update_stream_packet().rect_data().data().length();
+  if (src_size != src_stride * rect_height_)
+    return false;
+
+  // Make sure there's enough space for us to write to.
+  if (frame_->height() < static_cast<size_t>(rect_height_) ||
+      frame_->stride(media::VideoFrame::kRGBPlane) < src_stride) {
+    return false;
+  }
+
   int src_stride_dir = src_stride;
   if (reverse_rows_) {
     // Copy rows from bottom to top to flip the image vertically.
     src += (rect_height_ - 1) * src_stride;
     // Change the direction of the stride to work bottom to top.
     src_stride_dir *= -1;
   }
   const int dest_stride = frame_->stride(media::VideoFrame::kRGBPlane);
   uint8* dest = frame_->data(media::VideoFrame::kRGBPlane) +
       dest_stride * rect_y_ + bytes_per_pixel_ * rect_x_;
@@ skipping 10 matching lines @@
   return true;
 }
 
 bool DecoderVerbatim::HandleEndRect(ChromotingHostMessage* message) {
   DCHECK_EQ(kWaitingForRectData, state_);
   state_ = kWaitingForBeginRect;
   return true;
 }
 
 }  // namespace remoting