ozone: Validate the memory buffer used.

ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.h"
 
 #include <fcntl.h>
 #include <stddef.h>
 #include <sys/mman.h>
 #include <xf86drm.h>
@@ skipping 42 matching lines @@
 }
 
 }  // namespace
 
 // static
 std::unique_ptr<ClientNativePixmap> ClientNativePixmapDmaBuf::ImportFromDmabuf(
     int dmabuf_fd,
     const gfx::Size& size,
     int stride) {
   DCHECK_GE(dmabuf_fd, 0);
-  return base::WrapUnique(
-      new ClientNativePixmapDmaBuf(dmabuf_fd, size, stride));
+  base::CheckedNumeric<size_t> map_size = stride;
+  map_size *= size.height();
+  if (!map_size.IsValid())
+    return nullptr;
+  return base::WrapUnique(new ClientNativePixmapDmaBuf(dmabuf_fd, size, stride,
+                                                       map_size.ValueOrDie()));
 }
 
 ClientNativePixmapDmaBuf::ClientNativePixmapDmaBuf(int dmabuf_fd,
                                                    const gfx::Size& size,
-                                                   int stride)
-    : dmabuf_fd_(dmabuf_fd), size_(size), stride_(stride) {
+                                                   int stride,
+                                                   size_t map_size)
+    : dmabuf_fd_(dmabuf_fd), map_size_(map_size), size_(size), stride_(stride) {
   TRACE_EVENT0("drm", "ClientNativePixmapDmaBuf");
-  size_t map_size = stride_ * size_.height();
-  data_ = mmap(nullptr, map_size, (PROT_READ | PROT_WRITE), MAP_SHARED,
+  data_ = mmap(nullptr, map_size_, (PROT_READ | PROT_WRITE), MAP_SHARED,
                dmabuf_fd, 0);
   if (data_ == MAP_FAILED) {
     PLOG(ERROR) << "Failed mmap().";
-    base::TerminateBecauseOutOfMemory(map_size);
+    base::TerminateBecauseOutOfMemory(map_size_);
   }
 }
 
 ClientNativePixmapDmaBuf::~ClientNativePixmapDmaBuf() {
   TRACE_EVENT0("drm", "~ClientNativePixmapDmaBuf");
-  size_t size = stride_ * size_.height();
-  int ret = munmap(data_, size);
+  int ret = munmap(data_, map_size_);
   DCHECK(!ret);
 }
 
 void* ClientNativePixmapDmaBuf::Map() {
   TRACE_EVENT0("drm", "DmaBuf:Map");
   PrimeSyncStart(dmabuf_fd_.get());
   return data_;
 }
 
 void ClientNativePixmapDmaBuf::Unmap() {
   TRACE_EVENT0("drm", "DmaBuf:Unmap");
   PrimeSyncEnd(dmabuf_fd_.get());
 }
 
 void ClientNativePixmapDmaBuf::GetStride(int* stride) const {
   *stride = stride_;
 }
 
 }  // namespace ui