Add validation to length, packets and packetLength parameters

chrome/browser/usb/usb_device.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/usb/usb_device.h"
 
 #include "base/stl_util.h"
 #include "base/synchronization/lock.h"
 #include "chrome/browser/usb/usb_service.h"
 #include "third_party/libusb/src/libusb/libusb.h"
@@ skipping 259 matching lines @@
   SubmitTransfer(transfer, USB_TRANSFER_INTERRUPT, buffer, length, callback);
 }
 
 void UsbDevice::IsochronousTransfer(const TransferDirection direction,
     const uint8 endpoint, net::IOBuffer* buffer, const size_t length,
     const unsigned int packets, const unsigned int packet_length,
     const unsigned int timeout, const UsbTransferCallback& callback) {
   CheckDevice();
 
   const uint64 total_length = packets * packet_length;
-  if (total_length > length) {
-    callback.Run(USB_TRANSFER_LENGTH_SHORT, NULL, 0);
-    return;
-  }
+  CHECK(packets <= length && total_length <= length) <<
+      "transfer length is too small";
 
   struct libusb_transfer* const transfer = libusb_alloc_transfer(packets);
   const uint8 new_endpoint = ConvertTransferDirection(direction) | endpoint;
   libusb_fill_iso_transfer(transfer, handle_, new_endpoint,
       reinterpret_cast<uint8*>(buffer->data()), length, packets,
       HandleTransferCompletion, this, timeout);
   libusb_set_iso_packet_lengths(transfer, packet_length);
 
   SubmitTransfer(transfer, USB_TRANSFER_ISOCHRONOUS, buffer, length, callback);
 }
@@ skipping 12 matching lines @@
   transfer.buffer = buffer;
   transfer.length = length;
   transfer.callback = callback;
 
   {
     base::AutoLock lock(lock_);
     transfers_[handle] = transfer;
     libusb_submit_transfer(handle);
   }
 }