| Index: content/common/gpu/gpu_channel.cc
|
| diff --git a/content/common/gpu/gpu_channel.cc b/content/common/gpu/gpu_channel.cc
|
| index 746bc11519a879f99fd18bbf6964e7a639884d98..f8559b9ff9e716dfbb419155b549a7662f076dec 100644
|
| --- a/content/common/gpu/gpu_channel.cc
|
| +++ b/content/common/gpu/gpu_channel.cc
|
| @@ -17,6 +17,7 @@
|
| #include "base/bind.h"
|
| #include "base/command_line.h"
|
| #include "base/location.h"
|
| +#include "base/numerics/safe_conversions.h"
|
| #include "base/single_thread_task_runner.h"
|
| #include "base/stl_util.h"
|
| #include "base/strings/string_util.h"
|
| @@ -1040,10 +1041,14 @@ scoped_refptr<gl::GLImage> GpuChannel::CreateImageForGpuMemoryBuffer(
|
| uint32 internalformat) {
|
| switch (handle.type) {
|
| case gfx::SHARED_MEMORY_BUFFER: {
|
| + if (!base::IsValueInRangeForNumericType<size_t>(handle.stride))
|
| + return nullptr;
|
| scoped_refptr<gl::GLImageSharedMemory> image(
|
| new gl::GLImageSharedMemory(size, internalformat));
|
| - if (!image->Initialize(handle.handle, handle.id, format, handle.offset))
|
| + if (!image->Initialize(handle.handle, handle.id, format, handle.offset,
|
| + handle.stride)) {
|
| return nullptr;
|
| + }
|
|
|
| return image;
|
| }
|
|
|