Validate input from devtools channel to ensure that position is valid.

content/browser/devtools/protocol/input_handler.cc

Index: content/browser/devtools/protocol/input_handler.cc
diff --git a/content/browser/devtools/protocol/input_handler.cc b/content/browser/devtools/protocol/input_handler.cc
index cadff830717077c5d4a4ca6d0716f6fec6032d4e..967dd2cd21e0a91ca65631cfd8d26ecea4d3a5ba 100644
--- a/content/browser/devtools/protocol/input_handler.cc
+++ b/content/browser/devtools/protocol/input_handler.cc
@@ -475,6 +475,11 @@ void InputHandler::SynthesizePinchGesture(
 
   gesture_params.scale_factor = scale_factor;
   gesture_params.anchor = CssPixelsToPointF(x, y, page_scale_factor_);
+  if (!PointIsWithinContents(gesture_params.anchor)) {
+    callback->sendFailure(Response::InvalidParams("Position out of bounds"));
+    return;
+  }
+
   gesture_params.relative_pointer_speed_in_pixels_s =
       relative_speed.fromMaybe(kDefaultRelativeSpeed);
 
@@ -516,11 +521,16 @@ void InputHandler::SynthesizeScrollGesture(
   const int kDefaultSpeed = 800;
 
   gesture_params.anchor = CssPixelsToPointF(x, y, page_scale_factor_);
+  if (!PointIsWithinContents(gesture_params.anchor)) {
+    callback->sendFailure(Response::InvalidParams("Position out of bounds"));
+    return;
+  }
+
   gesture_params.prevent_fling =
       prevent_fling.fromMaybe(kDefaultPreventFling);
   gesture_params.speed_in_pixels_s = speed.fromMaybe(kDefaultSpeed);
 
-  if (x_distance.fromJust() || y_distance.fromJust()) {
+  if (x_distance.isJust() || y_distance.isJust()) {
     gesture_params.distances.push_back(
         CssPixelsToVector2dF(x_distance.fromMaybe(0),
                              y_distance.fromMaybe(0), page_scale_factor_));
@@ -610,6 +620,11 @@ void InputHandler::SynthesizeTapGesture(
   const int kDefaultTapCount = 1;
 
   gesture_params.position = CssPixelsToPointF(x, y, page_scale_factor_);
+  if (!PointIsWithinContents(gesture_params.position)) {
+    callback->sendFailure(Response::InvalidParams("Position out of bounds"));
+    return;
+  }
+
   gesture_params.duration_ms = duration.fromMaybe(kDefaultDuration);
 
   if (!StringToGestureSourceType(
@@ -645,5 +660,11 @@ void InputHandler::ClearPendingKeyAndMouseCallbacks() {
   pending_mouse_callbacks_.clear();
 }
 
+bool InputHandler::PointIsWithinContents(gfx::PointF point) const {
+  gfx::Rect bounds = host_->GetView()->GetViewBounds();
+  bounds -= bounds.OffsetFromOrigin();  // Translate the bounds to (0,0).
+  return bounds.Contains(point.x(), point.y());
+}
+
 }  // namespace protocol
 }  // namespace content