Validate Bucket data in ShaderSourceBucket.

gpu/command_buffer/service/gles2_cmd_decoder.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/gles2_cmd_decoder.h"
 
 #include <stdio.h>
 
 #include <algorithm>
 #include <list>
@@ skipping 7072 matching lines @@
 
 error::Error GLES2DecoderImpl::HandleShaderSourceBucket(
     uint32 immediate_data_size,
     const void* cmd_data) {
   const gles2::cmds::ShaderSourceBucket& c =
       *static_cast<const gles2::cmds::ShaderSourceBucket*>(cmd_data);
   Bucket* bucket = GetBucket(c.data_bucket_id);
   if (!bucket || bucket->size() == 0) {
     return error::kInvalidArguments;
   }
+
+  if (!bucket->GetData(0, bucket->size() - 1)) {

[Zhenyao Mo, 2014/12/31 00:13:47]

Good catch.  But instead of checking it here, it makes more sense to strengthen
the CommonDecoder::Bucket::SetSize to handle mem allocation failure, i.e., when
mem alloc fails, set size to 0.

[sivag, 2014/12/31 11:22:19]

Done.

+    return error::kOutOfBounds;
+  }
+
   return ShaderSourceHelper(
       c.shader, bucket->GetDataAs<const char*>(0, bucket->size() - 1),
       bucket->size() - 1);
 }
 
 void GLES2DecoderImpl::DoCompileShader(GLuint client_id) {
   TRACE_EVENT0("gpu", "GLES2DecoderImpl::DoCompileShader");
   Shader* shader = GetShaderInfoNotProgram(client_id, "glCompileShader");
   if (!shader) {
     return;
@@ skipping 4459 matching lines @@
   }
 }
 
 // Include the auto-generated part of this file. We split this because it means
 // we can easily edit the non-auto generated parts right here in this file
 // instead of having to edit some template or the code generator.
 #include "gpu/command_buffer/service/gles2_cmd_decoder_autogen.h"
 
 }  // namespace gles2
 }  // namespace gpu