Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(250)

Unified Diff: content/browser/renderer_host/software_frame_manager.cc

Issue 196423027: Move SoftwareFrameData overflow checks to the IPC code. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: softwareframesize: Created 6 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « cc/output/software_frame_data.cc ('k') | content/common/cc_messages.h » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: content/browser/renderer_host/software_frame_manager.cc
diff --git a/content/browser/renderer_host/software_frame_manager.cc b/content/browser/renderer_host/software_frame_manager.cc
index 387dc00d5287ed2c9ad0ebd2cf05f811b6cc8237..3630e59c05f8974126a4f6bbe51b4be6c88ca718 100644
--- a/content/browser/renderer_host/software_frame_manager.cc
+++ b/content/browser/renderer_host/software_frame_manager.cc
@@ -97,15 +97,9 @@ bool SoftwareFrameManager::SwapToNewFrame(
// The NULL handle is used in testing.
if (base::SharedMemory::IsHandleValid(shared_memory->handle())) {
- base::CheckedNumeric<size_t> size_in_bytes_checked =
- base::CheckedNumeric<size_t>(4) *
- base::CheckedNumeric<size_t>(frame_data->size.width()) *
- base::CheckedNumeric<size_t>(frame_data->size.height());
- if (!size_in_bytes_checked.IsValid()) {
- DLOG(ERROR) << "Integer overflow when computing bytes to map.";
- return false;
- }
- size_t size_in_bytes = size_in_bytes_checked.ValueOrDie();
+ DCHECK(frame_data->CheckedSizeInBytes().IsValid())
+ << "Integer overflow when computing bytes to map.";
+ size_t size_in_bytes = frame_data->SizeInBytes();
#ifdef OS_WIN
if (!shared_memory->Map(0)) {
DLOG(ERROR) << "Unable to map renderer memory.";
« no previous file with comments | « cc/output/software_frame_data.cc ('k') | content/common/cc_messages.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698