Make sure buffers are large enough to hold the Result structure.

gpu/command_buffer/service/common_decoder.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/common_decoder.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>
@@ skipping 125 matching lines @@
                                             unsigned int data_size) {
   CHECK(engine_);
   scoped_refptr<gpu::Buffer> buffer = engine_->GetSharedMemoryBuffer(shm_id);
   if (!buffer.get())
     return NULL;
   return buffer->GetDataAddress(data_offset, data_size);
 }
 
 void* CommonDecoder::GetAddressAndSize(unsigned int shm_id,
                                        unsigned int data_offset,
+                                       unsigned int minimum_size,
                                        unsigned int* data_size) {
   CHECK(engine_);
   scoped_refptr<gpu::Buffer> buffer = engine_->GetSharedMemoryBuffer(shm_id);
-  if (!buffer.get())
+  if (!buffer.get() || buffer->GetRemainingSize(data_offset) < minimum_size)
     return NULL;
   return buffer->GetDataAddressAndSize(data_offset, data_size);
 }
 
 unsigned int CommonDecoder::GetSharedMemorySize(unsigned int shm_id,
                                                 unsigned int offset) {
   CHECK(engine_);
   scoped_refptr<gpu::Buffer> buffer = engine_->GetSharedMemoryBuffer(shm_id);
   if (!buffer.get())
     return 0;
@@ skipping 192 matching lines @@
   }
   const void* src = bucket->GetData(offset, size);
   if (!src) {
       return error::kInvalidArguments;
   }
   memcpy(data, src, size);
   return error::kNoError;
 }
 
 }  // namespace gpu