Index: content/common/gpu/gpu_channel.cc |
diff --git a/content/common/gpu/gpu_channel.cc b/content/common/gpu/gpu_channel.cc |
index 746bc11519a879f99fd18bbf6964e7a639884d98..f8559b9ff9e716dfbb419155b549a7662f076dec 100644 |
--- a/content/common/gpu/gpu_channel.cc |
+++ b/content/common/gpu/gpu_channel.cc |
@@ -17,6 +17,7 @@ |
#include "base/bind.h" |
#include "base/command_line.h" |
#include "base/location.h" |
+#include "base/numerics/safe_conversions.h" |
#include "base/single_thread_task_runner.h" |
#include "base/stl_util.h" |
#include "base/strings/string_util.h" |
@@ -1040,10 +1041,14 @@ scoped_refptr<gl::GLImage> GpuChannel::CreateImageForGpuMemoryBuffer( |
uint32 internalformat) { |
switch (handle.type) { |
case gfx::SHARED_MEMORY_BUFFER: { |
+ if (!base::IsValueInRangeForNumericType<size_t>(handle.stride)) |
+ return nullptr; |
scoped_refptr<gl::GLImageSharedMemory> image( |
new gl::GLImageSharedMemory(size, internalformat)); |
- if (!image->Initialize(handle.handle, handle.id, format, handle.offset)) |
+ if (!image->Initialize(handle.handle, handle.id, format, handle.offset, |
+ handle.stride)) { |
return nullptr; |
+ } |
return image; |
} |