Use real colorspace for DirectComposition overlays.

gpu/command_buffer/service/gles2_cmd_decoder.cc

Index: gpu/command_buffer/service/gles2_cmd_decoder.cc
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder.cc b/gpu/command_buffer/service/gles2_cmd_decoder.cc
index 3651a90c5494e794652439e1b2b18b4e8a79b058..f02dae67308aab0e1d6757b55404784a7a03b546 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder.cc
+++ b/gpu/command_buffer/service/gles2_cmd_decoder.cc
@@ -12096,10 +12096,12 @@ error::Error GLES2DecoderImpl::HandleScheduleDCLayerCHROMIUM(
   }
 
   size_t textures_size = num_textures * sizeof(GLuint);
+  GLsizei color_space_size = c.color_space_size;
 
   base::CheckedNumeric<uint32_t> data_size = textures_size;
   const uint32_t kRectDataSize = 8 * sizeof(GLfloat);
   data_size += kRectDataSize;
+  data_size += color_space_size;
   if (!data_size.IsValid())
     return error::kOutOfBounds;
   const void* data =
@@ -12138,12 +12140,25 @@ error::Error GLES2DecoderImpl::HandleScheduleDCLayerCHROMIUM(
     images.push_back(image);
   }
 
+  volatile const char* volatile_color_space_data =
+      reinterpret_cast<volatile const char*>(data) + kRectDataSize +
+      textures_size;
+
+  // Make a copy to reduce the risk of a time of check to time of use attack.
+  std::vector<char> color_space_data(
+      volatile_color_space_data, volatile_color_space_data + color_space_size);
+  base::Pickle color_space_pickle(color_space_data.data(), color_space_size);
+  base::PickleIterator iterator(color_space_pickle);
+  gfx::ColorSpace color_space;
+  if (!color_space.ReadFromPickle(&iterator))
+    return error::kOutOfBounds;
+
   ui::DCRendererLayerParams params = ui::DCRendererLayerParams(
       dc_layer_shared_state_->is_clipped, dc_layer_shared_state_->clip_rect,
       dc_layer_shared_state_->z_order, dc_layer_shared_state_->transform,
       images, contents_rect, gfx::ToEnclosingRect(bounds_rect),
       c.background_color, c.edge_aa_mask, dc_layer_shared_state_->opacity,
-      filter);
+      filter, color_space);
   if (!surface_->ScheduleDCLayer(params)) {
     LOCAL_SET_GL_ERROR(GL_INVALID_OPERATION, "glScheduleDCLayerCHROMIUM",
                        "failed to schedule DCLayer");