Index: gpu/command_buffer/service/gles2_cmd_decoder.cc |
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder.cc b/gpu/command_buffer/service/gles2_cmd_decoder.cc |
index 3651a90c5494e794652439e1b2b18b4e8a79b058..f02dae67308aab0e1d6757b55404784a7a03b546 100644 |
--- a/gpu/command_buffer/service/gles2_cmd_decoder.cc |
+++ b/gpu/command_buffer/service/gles2_cmd_decoder.cc |
@@ -12096,10 +12096,12 @@ error::Error GLES2DecoderImpl::HandleScheduleDCLayerCHROMIUM( |
} |
size_t textures_size = num_textures * sizeof(GLuint); |
+ GLsizei color_space_size = c.color_space_size; |
base::CheckedNumeric<uint32_t> data_size = textures_size; |
const uint32_t kRectDataSize = 8 * sizeof(GLfloat); |
data_size += kRectDataSize; |
+ data_size += color_space_size; |
if (!data_size.IsValid()) |
return error::kOutOfBounds; |
const void* data = |
@@ -12138,12 +12140,25 @@ error::Error GLES2DecoderImpl::HandleScheduleDCLayerCHROMIUM( |
images.push_back(image); |
} |
+ volatile const char* volatile_color_space_data = |
+ reinterpret_cast<volatile const char*>(data) + kRectDataSize + |
+ textures_size; |
+ |
+ // Make a copy to reduce the risk of a time of check to time of use attack. |
+ std::vector<char> color_space_data( |
+ volatile_color_space_data, volatile_color_space_data + color_space_size); |
+ base::Pickle color_space_pickle(color_space_data.data(), color_space_size); |
+ base::PickleIterator iterator(color_space_pickle); |
+ gfx::ColorSpace color_space; |
+ if (!color_space.ReadFromPickle(&iterator)) |
+ return error::kOutOfBounds; |
+ |
ui::DCRendererLayerParams params = ui::DCRendererLayerParams( |
dc_layer_shared_state_->is_clipped, dc_layer_shared_state_->clip_rect, |
dc_layer_shared_state_->z_order, dc_layer_shared_state_->transform, |
images, contents_rect, gfx::ToEnclosingRect(bounds_rect), |
c.background_color, c.edge_aa_mask, dc_layer_shared_state_->opacity, |
- filter); |
+ filter, color_space); |
if (!surface_->ScheduleDCLayer(params)) { |
LOCAL_SET_GL_ERROR(GL_INVALID_OPERATION, "glScheduleDCLayerCHROMIUM", |
"failed to schedule DCLayer"); |