media: VideoFrame: add offset for shared memory buffers

content/common/gpu/gpu_messages.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Multiply-included message file, hence no include guard here, but see below
 // for a much smaller-than-usual include guard section.
 
 #include <string>
 #include <vector>
 
@@ skipping 691 matching lines @@
 // Video decoder has encountered an error.
 IPC_MESSAGE_ROUTED1(AcceleratedVideoDecoderHostMsg_ErrorNotification,
                     uint32) /* Error ID */
 
 //------------------------------------------------------------------------------
 // Accelerated Video Encoder Messages
 // These messages are sent from the Renderer process to GPU process.
 
 // Queue a input buffer to the encoder to encode. |frame_id| will be returned by
 // AcceleratedVideoEncoderHostMsg_NotifyInputDone.
-IPC_MESSAGE_ROUTED4(AcceleratedVideoEncoderMsg_Encode,
+IPC_MESSAGE_ROUTED5(AcceleratedVideoEncoderMsg_Encode,
                     int32 /* frame_id */,
                     base::SharedMemoryHandle /* buffer_handle */,
+                    uint32 /* buffer_offset */,

[DaleCurtis, 2015/01/30 18:44:59]

This seems dangerous...

[llandwerlin-old, 2015/01/31 22:42:53]

Can you explain why you think this could be dangerous?
I believe that wrong memory mapping parameters would just lead the mmap
operation to fail (for example with a buffer offset outside the buffer's limit).

[DaleCurtis, 2015/02/02 19:24:18]

An attacker controls both the buffer_offset and buffer_size in this case, which
without careful consideration on the endpoint may lead to issues.

                     uint32 /* buffer_size */,
                     bool /* force_keyframe */)
 
 // Queue a buffer to the encoder for use in returning output.  |buffer_id| will
 // be returned by AcceleratedVideoEncoderHostMsg_BitstreamBufferReady.
 IPC_MESSAGE_ROUTED3(AcceleratedVideoEncoderMsg_UseOutputBitstreamBuffer,
                     int32 /* buffer_id */,
                     base::SharedMemoryHandle /* buffer_handle */,
                     uint32 /* buffer_size */)
 
@@ skipping 24 matching lines @@
                     int32 /* bitstream_buffer_id */,
                     uint32 /* payload_size */,
                     bool /* key_frame */)
 
 // Report error condition.
 IPC_MESSAGE_ROUTED1(AcceleratedVideoEncoderHostMsg_NotifyError,
                     media::VideoEncodeAccelerator::Error /* error */)
 
 // Send destroy request to the encoder.
 IPC_MESSAGE_ROUTED0(AcceleratedVideoEncoderMsg_Destroy)