Index: content/common/gpu/client/gpu_memory_buffer_impl_shared_memory.cc |
diff --git a/content/common/gpu/client/gpu_memory_buffer_impl_shared_memory.cc b/content/common/gpu/client/gpu_memory_buffer_impl_shared_memory.cc |
index 5572c1fa2a92ab8422d61ebe7d65efef2b0818ae..78e5c710b8c1c8fcc0a52422c40098bddbacbddd 100644 |
--- a/content/common/gpu/client/gpu_memory_buffer_impl_shared_memory.cc |
+++ b/content/common/gpu/client/gpu_memory_buffer_impl_shared_memory.cc |
@@ -35,7 +35,8 @@ scoped_ptr<GpuMemoryBufferImpl> GpuMemoryBufferImplSharedMemory::Create( |
const gfx::Size& size, |
Format format) { |
scoped_ptr<base::SharedMemory> shared_memory(new base::SharedMemory()); |
- if (!shared_memory->CreateAnonymous(size.GetArea() * BytesPerPixel(format))) |
+ if (!shared_memory->CreateAnonymous( |
+ StrideInBytes(size.width(), format) * size.height())) |
return scoped_ptr<GpuMemoryBufferImpl>(); |
return make_scoped_ptr(new GpuMemoryBufferImplSharedMemory( |
@@ -49,9 +50,8 @@ GpuMemoryBufferImplSharedMemory::AllocateForChildProcess( |
const gfx::Size& size, |
Format format, |
base::ProcessHandle child_process) { |
- base::CheckedNumeric<int> buffer_size = size.width(); |
+ base::CheckedNumeric<int> buffer_size = StrideInBytes(size.width(), format); |
reveman
2014/12/18 18:49:56
Can a malicious renderer make this overflow? ie. w
christiank
2015/01/12 10:35:22
Should be fixed now that StrideInBytes uses Checke
|
buffer_size *= size.height(); |
- buffer_size *= BytesPerPixel(format); |
if (!buffer_size.IsValid()) |
return gfx::GpuMemoryBufferHandle(); |
@@ -101,7 +101,8 @@ bool GpuMemoryBufferImplSharedMemory::IsFormatSupported(Format format) { |
void* GpuMemoryBufferImplSharedMemory::Map() { |
DCHECK(!mapped_); |
- if (!shared_memory_->Map(size_.GetArea() * BytesPerPixel(format_))) |
+ if (!shared_memory_->Map( |
+ StrideInBytes(size_.width(), format_) * size_.height())) |
return NULL; |
mapped_ = true; |
return shared_memory_->memory(); |
@@ -114,7 +115,7 @@ void GpuMemoryBufferImplSharedMemory::Unmap() { |
} |
uint32 GpuMemoryBufferImplSharedMemory::GetStride() const { |
- return size_.width() * BytesPerPixel(format_); |
+ return StrideInBytes(size_.width(), format_); |
} |
gfx::GpuMemoryBufferHandle GpuMemoryBufferImplSharedMemory::GetHandle() const { |