Index: content/browser/gpu/gpu_process_host_ui_shim.cc |
diff --git a/content/browser/gpu/gpu_process_host_ui_shim.cc b/content/browser/gpu/gpu_process_host_ui_shim.cc |
index b17bc59faae752ffa98445671ceac7261a81bcdb..55253a654ce43ff6df904e8f11cfc0b44fbddc7f 100644 |
--- a/content/browser/gpu/gpu_process_host_ui_shim.cc |
+++ b/content/browser/gpu/gpu_process_host_ui_shim.cc |
@@ -36,6 +36,8 @@ namespace { |
#undef DestroyAll |
#endif |
+const unsigned int kMaxLatencyInfoNumber = 100; |
+ |
base::LazyInstance<IDMap<GpuProcessHostUIShim> > g_hosts_by_id = |
LAZY_INSTANCE_INITIALIZER; |
@@ -284,6 +286,11 @@ void GpuProcessHostUIShim::OnAcceleratedSurfaceBuffersSwapped( |
const GpuHostMsg_AcceleratedSurfaceBuffersSwapped_Params& params) { |
TRACE_EVENT0("renderer", |
"GpuProcessHostUIShim::OnAcceleratedSurfaceBuffersSwapped"); |
+ if (params.latency_info.size() > kMaxLatencyInfoNumber) { |
+ LOG(ERROR) << "GpuHostMsg_AcceleratedSurfaceBuffersSwapped LatencyInfo" |
+ << " size " << params.latency_info.size() << " is too big."; |
+ return; |
+ } |
AcceleratedSurfaceMsg_BufferPresented_Params ack_params; |
ack_params.mailbox_name = params.mailbox_name; |
ack_params.sync_point = 0; |
@@ -312,7 +319,13 @@ void GpuProcessHostUIShim::OnAcceleratedSurfaceBuffersSwapped( |
view->DidReceiveRendererFrame(); |
} |
-void GpuProcessHostUIShim::OnFrameDrawn(const ui::LatencyInfo& latency_info) { |
+void GpuProcessHostUIShim::OnFrameDrawn( |
+ const std::vector<ui::LatencyInfo>& latency_info) { |
+ if (latency_info.size() > kMaxLatencyInfoNumber) { |
+ LOG(ERROR) << "GpuProcessHostUIShim::OnFrameDrawn LatencyInfo" |
+ << " size " << latency_info.size() << " is too big."; |
+ return; |
+ } |
RenderWidgetHostImpl::CompositorFrameDrawn(latency_info); |
} |
@@ -320,7 +333,11 @@ void GpuProcessHostUIShim::OnAcceleratedSurfacePostSubBuffer( |
const GpuHostMsg_AcceleratedSurfacePostSubBuffer_Params& params) { |
TRACE_EVENT0("renderer", |
"GpuProcessHostUIShim::OnAcceleratedSurfacePostSubBuffer"); |
- |
+ if (params.latency_info.size() > kMaxLatencyInfoNumber) { |
+ LOG(ERROR) << "GpuHostMsg_AcceleratedSurfacePostSubBuffer LatencyInfo" |
+ << " size " << params.latency_info.size() << " is too big."; |
+ return; |
+ } |
AcceleratedSurfaceMsg_BufferPresented_Params ack_params; |
ack_params.mailbox_name = params.mailbox_name; |
ack_params.sync_point = 0; |