Add bounds validation to AsyncPixelTransfersCompletedQuery::End

gpu/command_buffer/service/query_manager.cc

Index: gpu/command_buffer/service/query_manager.cc
diff --git a/gpu/command_buffer/service/query_manager.cc b/gpu/command_buffer/service/query_manager.cc
index f323c3ee9288caa2bc0a3b304f077a0dd6ca0cd1..5d5757769f4457a2cac8bd2107b8874ab7c22a36 100644
--- a/gpu/command_buffer/service/query_manager.cc
+++ b/gpu/command_buffer/service/query_manager.cc
@@ -95,6 +95,9 @@ bool AsyncPixelTransfersCompletedQuery::End(
   mem_params.shm_size = buffer.size;
   mem_params.shm_data_offset = shm_offset();
   mem_params.shm_data_size = sizeof(QuerySync);
+  uint32 end = mem_params.shm_data_offset + mem_params.shm_data_size;
+  if (end > mem_params.shm_size || end < mem_params.shm_data_offset)

[Jorge Lucangeli Obes, 2014/03/12 22:56:44]

does |shm_size| just track a size or does it track the last valid offset?

+    return false;
 
   observer_ = new AsyncPixelTransferCompletionObserverImpl(submit_count);