Fix integer overflow in software compositor

content/browser/renderer_host/software_frame_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/software_frame_manager.h"
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
 #include "base/debug/alias.h"
+#include "base/numerics/safe_math.h"
 #include "content/browser/renderer_host/dip_util.h"
 #include "content/public/browser/user_metrics.h"
 
 namespace {
 
 void ReleaseMailbox(scoped_refptr<content::SoftwareFrame> frame,
                     uint32 sync_point,
                     bool lost_resource) {}
 
 }  // namespace
@@ skipping 69 matching lines @@
   scoped_ptr<base::SharedMemory> shared_memory(
       new base::SharedMemory(frame_data->handle, true,
                              process_handle));
 #else
   scoped_ptr<base::SharedMemory> shared_memory(
       new base::SharedMemory(frame_data->handle, true));
 #endif
 
   // The NULL handle is used in testing.
   if (base::SharedMemory::IsHandleValid(shared_memory->handle())) {
-    const size_t size_in_bytes = 4 * frame_data->size.GetArea();
+    base::CheckedNumeric<size_t> size_in_bytes_checked =
+        base::CheckedNumeric<size_t>(4) *
+        base::CheckedNumeric<size_t>(frame_data->size.width()) *
+        base::CheckedNumeric<size_t>(frame_data->size.height());

[jschuh, 2014/03/14 06:14:12]

This is fine, but is there a good reason not to have overflow checks in
gfx::SizeBase::GetArea() and gfx::SizeBase::Expand()? We can just have integer
overflow saturate to numeric_limits<Type>::max(), to preserve the current
interface (and it parallels flooring the negative values to zero elsewhere in
the class).

[ccameron, 2014/03/14 19:38:14]

Filed issue 352761 on it.

+    if (!size_in_bytes_checked.IsValid()) {
+      DLOG(ERROR) << "Integer overflow when computing bytes to map.";
+      return false;
+    }
+    size_t size_in_bytes = size_in_bytes_checked.ValueOrDie();
 #ifdef OS_WIN
     if (!shared_memory->Map(0)) {
       DLOG(ERROR) << "Unable to map renderer memory.";
       RecordAction(
           base::UserMetricsAction("BadMessageTerminate_SharedMemoryManager1"));
       return false;
     }
 
     if (shared_memory->mapped_size() < size_in_bytes) {
       DLOG(ERROR) << "Shared memory too small for given rectangle";
@@ skipping 87 matching lines @@
 }
 
 void SoftwareFrameManager::EvictCurrentFrame() {
   DCHECK(HasCurrentFrame());
   DiscardCurrentFrame();
   if (client_)
     client_->ReleaseReferencesToSoftwareFrame();
 }
 
 }  // namespace content