Update GPU memory buffers to use StrideInBytes internally.

content/common/gpu/client/gpu_memory_buffer_impl_shared_memory.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/gpu/client/gpu_memory_buffer_impl_shared_memory.h"
 
 #include "base/bind.h"
 #include "base/numerics/safe_math.h"
 #include "ui/gl/gl_bindings.h"
 
@@ skipping 17 matching lines @@
 
 GpuMemoryBufferImplSharedMemory::~GpuMemoryBufferImplSharedMemory() {
 }
 
 // static
 scoped_ptr<GpuMemoryBufferImpl> GpuMemoryBufferImplSharedMemory::Create(
     gfx::GpuMemoryBufferId id,
     const gfx::Size& size,
     Format format) {
   scoped_ptr<base::SharedMemory> shared_memory(new base::SharedMemory());
-  if (!shared_memory->CreateAnonymous(size.GetArea() * BytesPerPixel(format)))
+  if (!shared_memory->CreateAnonymous(
+          StrideInBytes(size.width(), format) * size.height()))
     return scoped_ptr<GpuMemoryBufferImpl>();
 
   return make_scoped_ptr(new GpuMemoryBufferImplSharedMemory(
       id, size, format, base::Bind(&Noop), shared_memory.Pass()));
 }
 
 // static
 gfx::GpuMemoryBufferHandle
 GpuMemoryBufferImplSharedMemory::AllocateForChildProcess(
     gfx::GpuMemoryBufferId id,
     const gfx::Size& size,
     Format format,
     base::ProcessHandle child_process) {
-  base::CheckedNumeric<int> buffer_size = size.width();
+  base::CheckedNumeric<int> buffer_size = StrideInBytes(size.width(), format);

[reveman, 2014/12/18 18:49:56]

Can a malicious renderer make this overflow? ie. what if size.width() is
INT_MAX?

[christiank, 2015/01/12 10:35:22]

Should be fixed now that StrideInBytes uses CheckedNumeric internally.

   buffer_size *= size.height();
-  buffer_size *= BytesPerPixel(format);
   if (!buffer_size.IsValid())
     return gfx::GpuMemoryBufferHandle();
 
   base::SharedMemory shared_memory;
   if (!shared_memory.CreateAnonymous(buffer_size.ValueOrDie()))
     return gfx::GpuMemoryBufferHandle();
 
   gfx::GpuMemoryBufferHandle handle;
   handle.type = gfx::SHARED_MEMORY_BUFFER;
   handle.id = id;
@@ skipping 29 matching lines @@
     case RGBX_8888:
       return false;
   }
 
   NOTREACHED();
   return false;
 }
 
 void* GpuMemoryBufferImplSharedMemory::Map() {
   DCHECK(!mapped_);
-  if (!shared_memory_->Map(size_.GetArea() * BytesPerPixel(format_)))
+  if (!shared_memory_->Map(
+          StrideInBytes(size_.width(), format_) * size_.height()))
     return NULL;
   mapped_ = true;
   return shared_memory_->memory();
 }
 
 void GpuMemoryBufferImplSharedMemory::Unmap() {
   DCHECK(mapped_);
   shared_memory_->Unmap();
   mapped_ = false;
 }
 
 uint32 GpuMemoryBufferImplSharedMemory::GetStride() const {
-  return size_.width() * BytesPerPixel(format_);
+  return StrideInBytes(size_.width(), format_);
 }
 
 gfx::GpuMemoryBufferHandle GpuMemoryBufferImplSharedMemory::GetHandle() const {
   gfx::GpuMemoryBufferHandle handle;
   handle.type = gfx::SHARED_MEMORY_BUFFER;
   handle.id = id_;
   handle.handle = shared_memory_->handle();
   return handle;
 }
 
 }  // namespace content