ozone: Validate the memory buffer used.

ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.h"
 
 #include <fcntl.h>
 #include <stddef.h>
 #include <sys/mman.h>
 #include <xf86drm.h>
@@ skipping 51 matching lines @@
   DCHECK_GE(dmabuf_fd, 0);
   return base::WrapUnique(
       new ClientNativePixmapDmaBuf(dmabuf_fd, size, stride));
 }
 
 ClientNativePixmapDmaBuf::ClientNativePixmapDmaBuf(int dmabuf_fd,
                                                    const gfx::Size& size,
                                                    int stride)
     : dmabuf_fd_(dmabuf_fd), size_(size), stride_(stride) {
   TRACE_EVENT0("drm", "ClientNativePixmapDmaBuf");
-  size_t map_size = stride_ * size_.height();
-  data_ = mmap(nullptr, map_size, (PROT_READ | PROT_WRITE), MAP_SHARED,
-               dmabuf_fd, 0);
+  base::CheckedNumeric<size_t> map_size = stride_;
+  map_size *= size_.height();
+  data_ = mmap(nullptr, map_size.ValueOrDie(), (PROT_READ | PROT_WRITE),

[rjkroege, 2016/09/01 20:45:05]

Won't this will kill the caller if the value is invalid. Is this really what we
want? What we really want is to kill the GPU process if this happens because it
sent us the bad data that brought us here instead of killing (for example) the
browser trying to map the provided GPU memory?

[sadrul, 2016/09/02 03:00:19]

As discussed offline, I have changed this code to not be fatal. But instead, it
will return null, instead of attempting to use the buffer. Killing the GPU isn't
straightforward from here. But it is possible (e.g. a quick hack:
https://codereview.chromium.org/2302733003/). I am going to continue to look
into that as the next step in a subsequent CL.

+               MAP_SHARED, dmabuf_fd, 0);
   if (data_ == MAP_FAILED) {
     PLOG(ERROR) << "Failed mmap().";
-    base::TerminateBecauseOutOfMemory(map_size);
+    base::TerminateBecauseOutOfMemory(map_size.ValueOrDie());
   }
 }
 
 ClientNativePixmapDmaBuf::~ClientNativePixmapDmaBuf() {
   TRACE_EVENT0("drm", "~ClientNativePixmapDmaBuf");
   size_t size = stride_ * size_.height();
   int ret = munmap(data_, size);
   DCHECK(!ret);
 }
 
 void* ClientNativePixmapDmaBuf::Map() {
   TRACE_EVENT0("drm", "DmaBuf:Map");
   PrimeSyncStart(dmabuf_fd_.get());
   return data_;
 }
 
 void ClientNativePixmapDmaBuf::Unmap() {
   TRACE_EVENT0("drm", "DmaBuf:Unmap");
   PrimeSyncEnd(dmabuf_fd_.get());
 }
 
 void ClientNativePixmapDmaBuf::GetStride(int* stride) const {
   *stride = stride_;
 }
 
 }  // namespace ui