Check for excessive dimensions.

gpu/command_buffer/service/gles2_cmd_decoder.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/gles2_cmd_decoder.h"
 
 #include <stdio.h>
 
 #include <algorithm>
 #include <list>
@@ skipping 2228 matching lines @@
   } else {
     return back_buffer_color_format_;
   }
 }
 
 bool GLES2DecoderImpl::UpdateOffscreenFrameBufferSize() {
   if (offscreen_size_ == pending_offscreen_size_)
     return true;
 
   offscreen_size_ = pending_offscreen_size_;
+  int w = offscreen_size_.width();
+  int h = offscreen_size_.height();
+  if (w < 0 || h < 0 || h >= (INT_MAX / 4) / (w ? w : 1)) {
+    LOG(ERROR) << "GLES2DecoderImpl::UpdateOffscreenFrameBufferSize failed "
+               << "to allocate storage due to excessive dimensions.";
+    return false;
+  }
 
   // Reallocate the offscreen target buffers.
   DCHECK(offscreen_target_color_format_);
   if (IsOffscreenBufferMultisampled()) {
     if (!offscreen_target_color_render_buffer_->AllocateStorage(
         pending_offscreen_size_, offscreen_target_color_format_,
         offscreen_target_samples_)) {
       LOG(ERROR) << "GLES2DecoderImpl::UpdateOffscreenFrameBufferSize failed "
                  << "to allocate storage for offscreen target color buffer.";
       return false;
@@ skipping 3886 matching lines @@
   return error::kNoError;
 }
 
 // Include the auto-generated part of this file. We split this because it means
 // we can easily edit the non-auto generated parts right here in this file
 // instead of having to edit some template or the code generator.
 #include "gpu/command_buffer/service/gles2_cmd_decoder_autogen.h"
 
 }  // namespace gles2
 }  // namespace gpu