Index: mojo/services/gles2/command_buffer_impl.cc |
diff --git a/mojo/services/gles2/command_buffer_impl.cc b/mojo/services/gles2/command_buffer_impl.cc |
index 71df2c5e7a9d9ed14cb0446528f7a7cdd42f6508..3fb9881a7a65801c3b2bc2f549c073968439c7e0 100644 |
--- a/mojo/services/gles2/command_buffer_impl.cc |
+++ b/mojo/services/gles2/command_buffer_impl.cc |
@@ -143,9 +143,16 @@ void CommandBufferImpl::MakeProgress(int32_t last_get_offset) { |
void CommandBufferImpl::RegisterTransferBuffer(int32_t id, |
const ShmHandle& transfer_buffer, |
uint32_t size) { |
- bool read_only = false; |
- base::SharedMemory shared_memory(transfer_buffer, read_only); |
- command_buffer_->RegisterTransferBuffer(id, &shared_memory, size); |
+ // Take ownership of the memory and map it into this process. |
+ // This validates the size. |
+ scoped_ptr<base::SharedMemory> shared_memory( |
+ new base::SharedMemory(transfer_buffer, false)); |
+ if (!shared_memory->Map(size)) { |
+ DVLOG(0) << "Failed to map shared memory."; |
+ return; |
+ } |
+ |
+ command_buffer_->RegisterTransferBuffer(id, shared_memory.Pass(), size); |
} |
void CommandBufferImpl::DestroyTransferBuffer(int32_t id) { |