Validate Bucket data in ShaderSourceBucket.

gpu/command_buffer/service/common_decoder.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/common_decoder.h"
 #include "gpu/command_buffer/service/cmd_buffer_engine.h"
 
 namespace gpu {
 
 CommonDecoder::Bucket::Bucket() : size_(0) {}
 
 CommonDecoder::Bucket::~Bucket() {}
 
 void* CommonDecoder::Bucket::GetData(size_t offset, size_t size) const {
   if (OffsetSizeValid(offset, size)) {
     return data_.get() + offset;
   }
   return NULL;
 }
 
-void CommonDecoder::Bucket::SetSize(size_t size) {
+bool CommonDecoder::Bucket::SetSize(size_t size) {
   if (size != size_) {
     data_.reset(size ? new int8[size] : NULL);
+    if (!data_.get() && (size != 0)) {
+      size_ = 0;
+      return false;
+    }
     size_ = size;
     memset(data_.get(), 0, size);
   }
+  return true;
 }
 
 bool CommonDecoder::Bucket::SetData(
     const void* src, size_t offset, size_t size) {
   if (OffsetSizeValid(offset, size)) {
     memcpy(data_.get() + offset, src, size);
     return true;
   }
   return false;
 }
@@ skipping 142 matching lines @@
   return error::kNoError;
 }
 
 error::Error CommonDecoder::HandleSetBucketSize(
     uint32 immediate_data_size,
     const cmd::SetBucketSize& args) {
   uint32 bucket_id = args.bucket_id;
   uint32 size = args.size;
 
   Bucket* bucket = CreateBucket(bucket_id);
-  bucket->SetSize(size);
+  if (!bucket->SetSize(size)) {
+    return error::kOutOfBounds;
+  }
   return error::kNoError;
 }
 
 error::Error CommonDecoder::HandleSetBucketData(
     uint32 immediate_data_size,
     const cmd::SetBucketData& args) {
   uint32 bucket_id = args.bucket_id;
   uint32 offset = args.offset;
   uint32 size = args.size;
   const void* data = GetSharedMemoryAs<const void*>(
@@ skipping 86 matching lines @@
   }
   const void* src = bucket->GetData(offset, size);
   if (!src) {
       return error::kInvalidArguments;
   }
   memcpy(data, src, size);
   return error::kNoError;
 }
 
 }  // namespace gpu