Add bounds validation to AsyncPixelTransfersCompletedQuery::End

gpu/command_buffer/service/query_manager.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/query_manager.h"
 
 #include "base/atomicops.h"
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/memory/shared_memory.h"
@@ skipping 77 matching lines @@
   AsyncMemoryParams mem_params;
   // Get the real shared memory since it might need to be duped to prevent
   // use-after-free of the memory.
   Buffer buffer = manager()->decoder()->GetSharedMemoryBuffer(shm_id());
   if (!buffer.shared_memory)
     return false;
   mem_params.shared_memory = buffer.shared_memory;
   mem_params.shm_size = buffer.size;
   mem_params.shm_data_offset = shm_offset();
   mem_params.shm_data_size = sizeof(QuerySync);
+  uint32 end = mem_params.shm_data_offset + mem_params.shm_data_size;
+  if (end > mem_params.shm_size || end < mem_params.shm_data_offset)

[Jorge Lucangeli Obes, 2014/03/12 22:56:44]

does |shm_size| just track a size or does it track the last valid offset?

+    return false;
 
   observer_ = new AsyncPixelTransferCompletionObserverImpl(submit_count);
 
   // Ask AsyncPixelTransferDelegate to run completion callback after all
   // previous async transfers are done. No guarantee that callback is run
   // on the current thread.
   manager()->decoder()->GetAsyncPixelTransferManager()
       ->AsyncNotifyCompletion(mem_params, observer_);
 
   return AddToPendingTransferQueue(submit_count);
@@ skipping 560 matching lines @@
 bool QueryManager::EndQuery(Query* query, base::subtle::Atomic32 submit_count) {
   DCHECK(query);
   if (!RemovePendingQuery(query)) {
     return false;
   }
   return query->End(submit_count);
 }
 
 }  // namespace gles2
 }  // namespace gpu