Check the size of bitmaps coming over IPC....

chrome/common/ipc_message_utils.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/ipc_message_utils.h"
 
 #include "base/gfx/rect.h"
 #include "googleurl/src/gurl.h"
 #include "SkBitmap.h"
 #include "webkit/glue/dom_operations.h"
@@ skipping 15 matching lines @@
   // The number of bytes between subsequent rows of the bitmap.
   uint32 fRowBytes;
 
   void InitSkBitmapDataForTransfer(const SkBitmap& bitmap) {
     fConfig = bitmap.config();
     fWidth = bitmap.width();
     fHeight = bitmap.height();
     fRowBytes = bitmap.rowBytes();
   }
 
-  void InitSkBitmapFromData(SkBitmap* bitmap, const char* pixels,
+  // Returns whether |bitmap| successfully initialized.
+  bool InitSkBitmapFromData(SkBitmap* bitmap, const char* pixels,
                             size_t total_pixels) const {
     if (total_pixels) {
       bitmap->setConfig(fConfig, fWidth, fHeight, fRowBytes);
       bitmap->allocPixels();

[cpu_(ooo_6.6-7.5), 2009/04/23 16:58:23]

can you check for the return value fo allocPixels()?

+      if (total_pixels > bitmap->getSize())
+        return false;
       memcpy(bitmap->getPixels(), pixels, total_pixels);
     }
+    return true;
   }
 };
 
 }  // namespace
 
 
 void ParamTraits<SkBitmap>::Write(Message* m, const SkBitmap& p) {
   size_t fixed_size = sizeof(SkBitmap_Data);
   SkBitmap_Data bmp_data;
   bmp_data.InitSkBitmapDataForTransfer(p);
@@ skipping 18 matching lines @@
 
   const char* variable_data;
   int variable_data_size = 0;
   if (!m->ReadData(iter, &variable_data, &variable_data_size) ||
      (variable_data_size < 0)) {
     NOTREACHED();
     return false;
   }
   const SkBitmap_Data* bmp_data =
       reinterpret_cast<const SkBitmap_Data*>(fixed_data);
-  bmp_data->InitSkBitmapFromData(r, variable_data, variable_data_size);
-  return true;
+  return bmp_data->InitSkBitmapFromData(r, variable_data, variable_data_size);
 }
 
 void ParamTraits<SkBitmap>::Log(const SkBitmap& p, std::wstring* l) {
   l->append(StringPrintf(L"<SkBitmap>"));
 }
 
 
 void ParamTraits<GURL>::Write(Message* m, const GURL& p) {
   m->WriteString(p.possibly_invalid_spec());
   // TODO(brettw) bug 684583: Add encoding for query params.
@@ skipping 114 matching lines @@
   }
   return result;
 }
 
 void ParamTraits<webkit_glue::WebApplicationInfo>::Log(
     const webkit_glue::WebApplicationInfo& p, std::wstring* l) {
   l->append(L"<WebApplicationInfo>");
 }
 
 }  // namespace IPC