Index: content/common/gpu/gpu_command_buffer_stub.cc |
diff --git a/content/common/gpu/gpu_command_buffer_stub.cc b/content/common/gpu/gpu_command_buffer_stub.cc |
index 8bccd2abd2f66732ce60175a50a2f87802dbc42a..ef6a45a2e1916e21ed9fc8ba7611a40ea9f23a7c 100644 |
--- a/content/common/gpu/gpu_command_buffer_stub.cc |
+++ b/content/common/gpu/gpu_command_buffer_stub.cc |
@@ -686,9 +686,18 @@ void GpuCommandBufferStub::OnRegisterTransferBuffer( |
base::SharedMemoryHandle transfer_buffer, |
uint32 size) { |
TRACE_EVENT0("gpu", "GpuCommandBufferStub::OnRegisterTransferBuffer"); |
- base::SharedMemory shared_memory(transfer_buffer, false); |
+ |
+ // Take ownership of the memory and map it into this process. |
+ // This validates the size. |
+ scoped_ptr<base::SharedMemory> shared_memory( |
+ new base::SharedMemory(transfer_buffer, false)); |
+ if (!shared_memory->Map(size)) { |
+ DVLOG(0) << "Failed to map shared memory."; |
+ return; |
+ } |
+ |
if (command_buffer_) |
- command_buffer_->RegisterTransferBuffer(id, &shared_memory, size); |
+ command_buffer_->RegisterTransferBuffer(id, shared_memory.Pass(), size); |
} |
void GpuCommandBufferStub::OnDestroyTransferBuffer(int32 id) { |