Improve validation when creating audio streams.

content/browser/renderer_host/media/audio_renderer_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/media/audio_renderer_host.h"
 
 #include "base/bind.h"
 #include "base/metrics/histogram.h"
 #include "base/process.h"
 #include "base/shared_memory.h"
@@ skipping 201 matching lines @@
     IPC_MESSAGE_HANDLER(AudioHostMsg_SetVolume, OnSetVolume)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP_EX()
 
   return handled;
 }
 
 void AudioRendererHost::OnCreateStream(
     int stream_id, const media::AudioParameters& params, int input_channels) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
-  DCHECK(LookupById(stream_id) == NULL);
+  // media::AudioParameters is validated in the deserializer.
+  if (input_channels < 0 ||
+      input_channels > media::limits::kMaxChannels ||
+      LookupById(stream_id) != NULL) {
+    SendErrorMessage(stream_id);
+    return;
+  }
 
   media::AudioParameters audio_params(params);
-  uint32 buffer_size = media::AudioBus::CalculateMemorySize(audio_params);
-  DCHECK_GT(buffer_size, 0U);
-  DCHECK_LE(buffer_size,
-            static_cast<uint32>(media::limits::kMaxPacketSizeInBytes));
-
-  DCHECK_GE(input_channels, 0);
-  DCHECK_LT(input_channels, media::limits::kMaxChannels);
 
   // Calculate output and input memory size.
   int output_memory_size = AudioBus::CalculateMemorySize(audio_params);
-  DCHECK_GT(output_memory_size, 0);
 
   int frames = audio_params.frames_per_buffer();
   int input_memory_size =
       AudioBus::CalculateMemorySize(input_channels, frames);
 
-  DCHECK_GE(input_memory_size, 0);
-
   scoped_ptr<AudioEntry> entry(new AudioEntry());
 
   // Create the shared memory and share with the renderer process.
   // For synchronized I/O (if input_channels > 0) then we allocate
   // extra memory after the output data for the input data.
   uint32 io_buffer_size = output_memory_size + input_memory_size;
 
   uint32 shared_memory_size =
       media::TotalSharedMemorySizeInBytes(io_buffer_size);
   if (!entry->shared_memory.CreateAndMapAnonymous(shared_memory_size)) {
@@ skipping 182 matching lines @@
   return NULL;
 }
 
 media::AudioOutputController* AudioRendererHost::LookupControllerByIdForTesting(
     int stream_id) {
   AudioEntry* const entry = LookupById(stream_id);
   return entry ? entry->controller : NULL;
 }
 
 }  // namespace content