ozone: Validate the memory buffer used.

ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.cc

Index: ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.cc
diff --git a/ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.cc b/ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.cc
index 9f9288d56fa316de1bebba9ad6bcafed84844d01..321f06b0b5ab914feaa6767c448d3a078fb8d906 100644
--- a/ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.cc
+++ b/ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.cc
@@ -60,28 +60,30 @@ std::unique_ptr<ClientNativePixmap> ClientNativePixmapDmaBuf::ImportFromDmabuf(
     const gfx::Size& size,
     int stride) {
   DCHECK_GE(dmabuf_fd, 0);
+  base::CheckedNumeric<size_t> map_size = stride;
+  map_size *= size.height();
+  if (!map_size.IsValid())
+    return nullptr;
   return base::WrapUnique(
-      new ClientNativePixmapDmaBuf(dmabuf_fd, size, stride));
+      new ClientNativePixmapDmaBuf(dmabuf_fd, stride, map_size.ValueOrDie()));
 }
 
 ClientNativePixmapDmaBuf::ClientNativePixmapDmaBuf(int dmabuf_fd,
-                                                   const gfx::Size& size,
-                                                   int stride)
-    : dmabuf_fd_(dmabuf_fd), size_(size), stride_(stride) {
+                                                   int stride,
+                                                   size_t map_size)
+    : dmabuf_fd_(dmabuf_fd), map_size_(map_size), stride_(stride) {

[rjkroege, 2016/09/02 19:02:03]

Can you retain the gfx::size in the class? It might become necessary for the
ioctls. Or other uses. Otherwise, I agree with the thrust of the CL.

[sadrul, 2016/09/02 19:07:17]

Done.

   TRACE_EVENT0("drm", "ClientNativePixmapDmaBuf");
-  size_t map_size = stride_ * size_.height();
-  data_ = mmap(nullptr, map_size, (PROT_READ | PROT_WRITE), MAP_SHARED,
+  data_ = mmap(nullptr, map_size_, (PROT_READ | PROT_WRITE), MAP_SHARED,
                dmabuf_fd, 0);
   if (data_ == MAP_FAILED) {
     PLOG(ERROR) << "Failed mmap().";
-    base::TerminateBecauseOutOfMemory(map_size);
+    base::TerminateBecauseOutOfMemory(map_size_);
   }
 }
 
 ClientNativePixmapDmaBuf::~ClientNativePixmapDmaBuf() {
   TRACE_EVENT0("drm", "~ClientNativePixmapDmaBuf");
-  size_t size = stride_ * size_.height();
-  int ret = munmap(data_, size);
+  int ret = munmap(data_, map_size_);
   DCHECK(!ret);
 }