Check the size of bitmaps coming over IPC....

chrome/common/ipc_message_utils.cc

Index: chrome/common/ipc_message_utils.cc
===================================================================
--- chrome/common/ipc_message_utils.cc	(revision 14286)
+++ chrome/common/ipc_message_utils.cc	(working copy)
@@ -33,13 +33,17 @@
     fRowBytes = bitmap.rowBytes();
   }
 
-  void InitSkBitmapFromData(SkBitmap* bitmap, const char* pixels,
+  // Returns whether |bitmap| successfully initialized.
+  bool InitSkBitmapFromData(SkBitmap* bitmap, const char* pixels,
                             size_t total_pixels) const {
     if (total_pixels) {
       bitmap->setConfig(fConfig, fWidth, fHeight, fRowBytes);
       bitmap->allocPixels();

[cpu_(ooo_6.6-7.5), 2009/04/23 16:58:23]

can you check for the return value fo allocPixels()?

+      if (total_pixels > bitmap->getSize())
+        return false;
       memcpy(bitmap->getPixels(), pixels, total_pixels);
     }
+    return true;
   }
 };
 
@@ -78,8 +82,7 @@
   }
   const SkBitmap_Data* bmp_data =
       reinterpret_cast<const SkBitmap_Data*>(fixed_data);
-  bmp_data->InitSkBitmapFromData(r, variable_data, variable_data_size);
-  return true;
+  return bmp_data->InitSkBitmapFromData(r, variable_data, variable_data_size);
 }
 
 void ParamTraits<SkBitmap>::Log(const SkBitmap& p, std::wstring* l) {