Added more checks for buffer size to crash safely in case of incorrect driver behavior.

printing/backend/win_helper.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "printing/backend/win_helper.h"
 
 #include <algorithm>
 
 #include "base/file_version_info.h"
 #include "base/files/file_path.h"
@@ skipping 451 matching lines @@
   scoped_ptr<DEVMODE[]> ticket = printing::XpsTicketToDevMode(printer_name,
                                                               xps_ticket);
   if (!ticket)
     return default.Pass();
 
   return ticket.Pass();
 }
 
 PRINTING_EXPORT scoped_ptr<DEVMODE[]> CreateDevMode(HANDLE printer,
                                                     DEVMODE* in) {
-  DWORD flags = in ? (DM_IN_BUFFER) : 0;
-  LONG buffer_size = DocumentProperties(NULL, printer, L"", NULL, in, flags);
+  LONG buffer_size = DocumentProperties(NULL, printer, L"", NULL, NULL, 0);
   if (buffer_size <= 0)
     return scoped_ptr<DEVMODE[]>();
+  CHECK_GE(buffer_size, static_cast<int>(sizeof(DEVMODE)));
   scoped_ptr<DEVMODE[]> out(
       reinterpret_cast<DEVMODE*>(new uint8[buffer_size]));
-  flags |= DM_OUT_BUFFER;
+  DWORD flags = (in ? (DM_IN_BUFFER) : 0) | DM_OUT_BUFFER;
   if (DocumentProperties(NULL, printer, L"", out.get(), in, flags) != IDOK)
     return scoped_ptr<DEVMODE[]>();
-  DCHECK_EQ(buffer_size, out.get()->dmSize + out.get()->dmDriverExtra);
+  CHECK_GE(buffer_size, out.get()->dmSize + out.get()->dmDriverExtra);
   return out.Pass();
 }
 
 }  // namespace printing