Add some bounds for gfx ipc deserialization.

content/public/common/common_param_traits.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/public/common/common_param_traits.h"
 
 #include "content/public/common/content_constants.h"
 #include "content/public/common/referrer.h"
 #include "net/base/host_port_pair.h"
 #include "third_party/skia/include/core/SkBitmap.h"
@@ skipping 151 matching lines @@
   r->set_x(x);
   r->set_y(y);
   return true;
 }
 
 void ParamTraits<gfx::PointF>::Log(const gfx::PointF& v, std::string* l) {
   l->append(base::StringPrintf("(%f, %f)", v.x(), v.y()));
 }
 
 void ParamTraits<gfx::Size>::Write(Message* m, const gfx::Size& p) {
+  DCHECK_GE(p.width(), 0);
+  DCHECK_GE(p.height(), 0);
   m->WriteInt(p.width());
   m->WriteInt(p.height());
 }
 
 bool ParamTraits<gfx::Size>::Read(const Message* m,
                                   PickleIterator* iter,
                                   gfx::Size* r) {
   int w, h;
-  if (!m->ReadInt(iter, &w) ||
-      !m->ReadInt(iter, &h))
+  if (!m->ReadInt(iter, &w) || w < 0 ||
+      !m->ReadInt(iter, &h) || h < 0)
     return false;
   r->set_width(w);
   r->set_height(h);
   return true;
 }
 
 void ParamTraits<gfx::Size>::Log(const gfx::Size& p, std::string* l) {
   l->append(base::StringPrintf("(%d, %d)", p.width(), p.height()));
 }
 
@@ skipping 54 matching lines @@
   r->set_x(x);
   r->set_y(y);
   return true;
 }
 
 void ParamTraits<gfx::Vector2dF>::Log(const gfx::Vector2dF& v, std::string* l) {
   l->append(base::StringPrintf("(%f, %f)", v.x(), v.y()));
 }
 
 void ParamTraits<gfx::Rect>::Write(Message* m, const gfx::Rect& p) {
-  m->WriteInt(p.x());
-  m->WriteInt(p.y());
-  m->WriteInt(p.width());
-  m->WriteInt(p.height());
+  WriteParam(m, p.origin());
+  WriteParam(m, p.size());
 }
 
 bool ParamTraits<gfx::Rect>::Read(const Message* m,
                                   PickleIterator* iter,
                                   gfx::Rect* r) {
-  int x, y, w, h;
-  if (!m->ReadInt(iter, &x) ||
-      !m->ReadInt(iter, &y) ||
-      !m->ReadInt(iter, &w) ||
-      !m->ReadInt(iter, &h))
+  gfx::Point origin;
+  gfx::Size size;
+  if (!ReadParam(m, iter, &origin) ||
+      !ReadParam(m, iter, &size))
     return false;
-  r->set_x(x);
-  r->set_y(y);
-  r->set_width(w);
-  r->set_height(h);
+  r->set_origin(origin);
+  r->set_size(size);
   return true;
 }
 
 void ParamTraits<gfx::Rect>::Log(const gfx::Rect& p, std::string* l) {
   l->append(base::StringPrintf("(%d, %d, %d, %d)", p.x(), p.y(),
                                p.width(), p.height()));
 }
 
 void ParamTraits<gfx::RectF>::Write(Message* m, const gfx::RectF& p) {
   ParamTraits<float>::Write(m, p.x());
@@ skipping 79 matching lines @@
 #undef CONTENT_PUBLIC_COMMON_COMMON_PARAM_TRAITS_MACROS_H_
 #include "content/public/common/common_param_traits_macros.h"
 }  // namespace IPC
 
 // Generate param traits log methods.
 #include "ipc/param_traits_log_macros.h"
 namespace IPC {
 #undef CONTENT_PUBLIC_COMMON_COMMON_PARAM_TRAITS_MACROS_H_
 #include "content/public/common/common_param_traits_macros.h"
 }  // namespace IPC