WebVR: Add sanity checks for decoded pose index values

third_party/WebKit/Source/modules/vr/VRDisplay.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/vr/VRDisplay.h"
 
 #include "core/css/StylePropertySet.h"
 #include "core/dom/DOMException.h"
 #include "core/dom/DocumentUserGestureToken.h"
 #include "core/dom/FrameRequestCallback.h"
@@ skipping 10 matching lines @@
 #include "modules/vr/VRFrameData.h"
 #include "modules/vr/VRLayer.h"
 #include "modules/vr/VRPose.h"
 #include "modules/vr/VRStageParameters.h"
 #include "modules/webgl/WebGLRenderingContextBase.h"
 #include "platform/Histogram.h"
 #include "platform/UserGestureIndicator.h"
 #include "public/platform/Platform.h"
 #include "wtf/AutoReset.h"
 
+#include <array>
+
 namespace blink {
 
 namespace {
 
+// Magic numbers used to mark valid pose index values encoded in frame
+// data. Must match the magic numbers used in vr_shell.cc.
+static constexpr std::array<uint8_t, 2> kWebVrPosePixelMagicNumbers{{42, 142}};
+
 VREye stringToVREye(const String& whichEye) {
   if (whichEye == "left")
     return VREyeLeft;
   if (whichEye == "right")
     return VREyeRight;
   return VREyeNone;
 }
 
 class VRDisplayFrameRequestCallback : public FrameRequestCallback {
  public:
@@ skipping 560 matching lines @@
 
   gl->Enable(GL_SCISSOR_TEST);
   // Use a few pixels to ensure we get a clean color. The resolution for the
   // WebGL buffer may not match the final rendered destination size, and
   // texture filtering could interfere for single pixels. This isn't visible
   // since the final rendering hides the edges via a vignette effect.
   gl->Scissor(0, 0, 4, 4);
   gl->ColorMask(GL_TRUE, GL_TRUE, GL_TRUE, GL_TRUE);
   int idx = m_framePose->poseIndex;
   // Careful with the arithmetic here. Float color 1.f is equivalent to int 255.
-  gl->ClearColor((idx & 255) / 255.0f, ((idx >> 8) & 255) / 255.0f,
-                 ((idx >> 16) & 255) / 255.0f, 1.0f);
+  // Use the low byte of the index as the red component, and store an arbitrary
+  // magic number in green/blue. This number must match the reading code in
+  // vr_shell.cc. Avoid all-black/all-white.
+  gl->ClearColor((idx & 255) / 255.0f, kWebVrPosePixelMagicNumbers[0] / 255.0f,
+                 kWebVrPosePixelMagicNumbers[1] / 255.0f, 1.0f);
   gl->Clear(GL_COLOR_BUFFER_BIT);
 
   // Set the GL state back to what was set by the WebVR application.
   m_renderingContext->restoreScissorEnabled();
   m_renderingContext->restoreScissorBox();
   m_renderingContext->restoreColorMask();
   m_renderingContext->restoreClearColor();
 
   m_display->SubmitFrame(m_framePose.Clone());
   m_canUpdateFramePose = true;
@@ skipping 74 matching lines @@
   visitor->trace(m_capabilities);
   visitor->trace(m_stageParameters);
   visitor->trace(m_eyeParametersLeft);
   visitor->trace(m_eyeParametersRight);
   visitor->trace(m_layer);
   visitor->trace(m_renderingContext);
   visitor->trace(m_scriptedAnimationController);
 }
 
 }  // namespace blink