Add bounds validation to AsyncPixelTransfersCompletedQuery::End

Add bounds validation to AsyncPixelTransfersCompletedQuery::End

BUG=351852
R=jbauman@chromium.org, jorgelo@chromium.org

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=256723

[piman, 2014-03-12 22:45:25]

jbauman, epenner: please review.
jorgelo: please security-review this.

[jbauman, 2014-03-12 22:49:10]

On 2014/03/12 22:45:25, piman wrote:
> jbauman, epenner: please review.
> jorgelo: please security-review this.

lgtm, though apparently jschuh@ added base/numerics/safe_math.h to make this
sort of stuff easier.

[Jorge Lucangeli Obes, 2014-03-12 22:56:43]

https://codereview.chromium.org/198253002/diff/1/gpu/command_buffer/service/q...
File gpu/command_buffer/service/query_manager.cc (right):

https://codereview.chromium.org/198253002/diff/1/gpu/command_buffer/service/q...
gpu/command_buffer/service/query_manager.cc:99: if (end > mem_params.shm_size ||
end < mem_params.shm_data_offset)
does |shm_size| just track a size or does it track the last valid offset?

[piman, 2014-03-12 23:04:21]

On 2014/03/12 22:56:43, Jorge Lucangeli Obes wrote:
>
https://codereview.chromium.org/198253002/diff/1/gpu/command_buffer/service/q...
> File gpu/command_buffer/service/query_manager.cc (right):
> 
>
https://codereview.chromium.org/198253002/diff/1/gpu/command_buffer/service/q...
> gpu/command_buffer/service/query_manager.cc:99: if (end > mem_params.shm_size
||
> end < mem_params.shm_data_offset)
> does |shm_size| just track a size or does it track the last valid offset?

It's the size of the shared memory (passed by the client, but validated earlier
by the Map())

[Jorge Lucangeli Obes, 2014-03-12 23:07:10]

lgtm

[piman, 2014-03-12 23:41:21]

The CQ bit was checked by piman@chromium.org

[commit-bot: I haz the power, 2014-03-12 23:42:42]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/piman@chromium.org/198253002/1

[piman, 2014-03-13 01:13:47]

Committed patchset #1 manually as r256723 (presubmit successful).