Use only DIPs size in ClientResolution.

remoting/protocol/host_control_dispatcher.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "remoting/protocol/host_control_dispatcher.h"
 
 #include "base/callback_helpers.h"
 #include "net/socket/stream_socket.h"
 #include "remoting/base/compound_buffer.h"
 #include "remoting/base/constants.h"
@@ skipping 57 matching lines @@
   DCHECK(host_stub_);
 
   std::unique_ptr<ControlMessage> message =
       ParseMessage<ControlMessage>(buffer.get());
   if (!message)
     return;
 
   if (message->has_clipboard_event()) {
     clipboard_stub_->InjectClipboardEvent(message->clipboard_event());
   } else if (message->has_client_resolution()) {
-    host_stub_->NotifyClientResolution(message->client_resolution());
+    const ClientResolution& resolution = message->client_resolution();
+    if (!resolution.has_dips_width() || !resolution.has_dips_height() ||
+        resolution.dips_width() <= 0 || resolution.dips_height() <= 0) {
+      LOG(ERROR) << "Received invalid ClientResolution message.";
+      return;
+    }
+    host_stub_->NotifyClientResolution(resolution);

[Jamie, 2016/05/31 20:40:47]

It seems odd that this is the only message we validate at this level. If you
think that this is the right place to validate, then this is fine as-is, but I
think we should add validation for the other messages here as well (not in this
CL).

[Sergey Ulanov, 2016/06/01 10:08:51]

Agree. Added a TODO.

   } else if (message->has_video_control()) {
     host_stub_->ControlVideo(message->video_control());
   } else if (message->has_audio_control()) {
     host_stub_->ControlAudio(message->audio_control());
   } else if (message->has_capabilities()) {
     host_stub_->SetCapabilities(message->capabilities());
   } else if (message->has_pairing_request()) {
     host_stub_->RequestPairing(message->pairing_request());
   } else if (message->has_extension_message()) {
     host_stub_->DeliverClientMessage(message->extension_message());
   } else {
     LOG(WARNING) << "Unknown control message received.";
   }
 }
 
 }  // namespace protocol
 }  // namespace remoting