Pepper: Make sure 'out' params are initialized for all code paths.

ppapi/proxy/ppb_image_data_proxy.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ppapi/proxy/ppb_image_data_proxy.h"
 
 #include <string.h>  // For memcpy
 
 #include <map>
 #include <vector>
@@ skipping 476 matching lines @@
   scoped_refptr<ImageData> cached_image_data =
       ImageDataCache::GetInstance()->Get(instance, type,
                                          size.width, size.height, format);
   if (cached_image_data.get()) {
     // We have one we can re-use rather than allocating a new one.
     cached_image_data->RecycleToPlugin(PP_ToBool(init_to_zero));
     return cached_image_data->GetReference();
   }
 
   HostResource result;
-  // Initialize desc so we don't send unitialized memory over IPC.
-  // https://crbug.com/391023.
-  PP_ImageDataDesc desc = {};
+  PP_ImageDataDesc desc;
   switch (type) {
     case PPB_ImageData_Shared::SIMPLE: {
       ppapi::proxy::SerializedHandle image_handle_wrapper;
       dispatcher->Send(new PpapiHostMsg_PPBImageData_CreateSimple(
           kApiID, instance, format, size, init_to_zero,
           &result, &desc, &image_handle_wrapper));
       if (image_handle_wrapper.is_shmem()) {
         base::SharedMemoryHandle image_handle = image_handle_wrapper.shmem();
         if (!result.is_null())
           return
@@ skipping 105 matching lines @@
 }
 
 void PPB_ImageData_Proxy::OnHostMsgCreatePlatform(
     PP_Instance instance,
     int32_t format,
     const PP_Size& size,
     PP_Bool init_to_zero,
     HostResource* result,
     PP_ImageDataDesc* desc,
     ImageHandle* result_image_handle) {
+  // Clear |desc| so we don't send unitialized memory to the plugin.
+  // https://crbug.com/391023.
+  memset(desc, 0, sizeof(*desc));

[dmichael (off chromium), 2014/07/11 15:22:25]

*desc = PP_ImageDataDesc();
?

[bbudge, 2014/07/11 15:23:40]

David, the reason I've gone back to memset is to ensure that padding bytes are
also cleared. In this case there are none, but this seems like a good pattern to
set.

[dmichael (off chromium), 2014/07/11 15:51:52]

Okay, that makes sense. still lgtm

[bbudge, 2014/07/11 17:01:55]

Sorry for churn, switching back to *desc = PP_ImageDataDesc() for clarity. This
isn't the right place to try to fix information leaks through padding.

   IPC::PlatformFileForTransit image_handle;
   uint32_t byte_count;
   PP_Resource resource =
       CreateImageData(instance,
                       PPB_ImageData_Shared::PLATFORM,
                       static_cast<PP_ImageDataFormat>(format),
                       size,
                       true /* init_to_zero */,
                       desc, &image_handle, &byte_count);
   result->SetHostResource(instance, resource);
   if (resource) {
     *result_image_handle = image_handle;
   } else {
     *result_image_handle = PlatformImageData::NullHandle();
   }
 }
 
 void PPB_ImageData_Proxy::OnHostMsgCreateSimple(
     PP_Instance instance,
     int32_t format,
     const PP_Size& size,
     PP_Bool init_to_zero,
     HostResource* result,
     PP_ImageDataDesc* desc,
     ppapi::proxy::SerializedHandle* result_image_handle) {
+  // Clear |desc| so we don't send unitialized memory to the plugin.
+  // https://crbug.com/391023.
+  memset(desc, 0, sizeof(*desc));
   IPC::PlatformFileForTransit image_handle;
   uint32_t byte_count;
   PP_Resource resource =
       CreateImageData(instance,
                       PPB_ImageData_Shared::SIMPLE,
                       static_cast<PP_ImageDataFormat>(format),
                       size,
                       true /* init_to_zero */,
                       desc, &image_handle, &byte_count);
 
@@ skipping 23 matching lines @@
   // still cached in our process, the proxy still holds a reference so we can
   // remove the one the renderer just sent is. If the proxy no longer holds a
   // reference, we released everything and we should also release the one the
   // renderer just sent us.
   dispatcher()->Send(new PpapiHostMsg_PPBCore_ReleaseResource(
       API_ID_PPB_CORE, old_image_data));
 }
 
 }  // namespace proxy
 }  // namespace ppapi