ozone: Validate the memory buffer used.

ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.cc

Index: ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.cc
diff --git a/ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.cc b/ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.cc
index 9f9288d56fa316de1bebba9ad6bcafed84844d01..9d35d0ac3f83e0c77c5706e2b507c009e59dacdf 100644
--- a/ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.cc
+++ b/ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.cc
@@ -69,12 +69,13 @@ ClientNativePixmapDmaBuf::ClientNativePixmapDmaBuf(int dmabuf_fd,
                                                    int stride)
     : dmabuf_fd_(dmabuf_fd), size_(size), stride_(stride) {
   TRACE_EVENT0("drm", "ClientNativePixmapDmaBuf");
-  size_t map_size = stride_ * size_.height();
-  data_ = mmap(nullptr, map_size, (PROT_READ | PROT_WRITE), MAP_SHARED,
-               dmabuf_fd, 0);
+  base::CheckedNumeric<size_t> map_size = stride_;
+  map_size *= size_.height();
+  data_ = mmap(nullptr, map_size.ValueOrDie(), (PROT_READ | PROT_WRITE),

[rjkroege, 2016/09/01 20:45:05]

Won't this will kill the caller if the value is invalid. Is this really what we
want? What we really want is to kill the GPU process if this happens because it
sent us the bad data that brought us here instead of killing (for example) the
browser trying to map the provided GPU memory?

[sadrul, 2016/09/02 03:00:19]

As discussed offline, I have changed this code to not be fatal. But instead, it
will return null, instead of attempting to use the buffer. Killing the GPU isn't
straightforward from here. But it is possible (e.g. a quick hack:
https://codereview.chromium.org/2302733003/). I am going to continue to look
into that as the next step in a subsequent CL.

+               MAP_SHARED, dmabuf_fd, 0);
   if (data_ == MAP_FAILED) {
     PLOG(ERROR) << "Failed mmap().";
-    base::TerminateBecauseOutOfMemory(map_size);
+    base::TerminateBecauseOutOfMemory(map_size.ValueOrDie());
   }
 }