media: VideoFrame: add offset for shared memory buffers

content/common/gpu/media/gpu_video_encode_accelerator.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/gpu/media/gpu_video_encode_accelerator.h"
 
 #include "base/callback.h"
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/memory/shared_memory.h"
 #include "base/message_loop/message_loop_proxy.h"
+#include "base/sys_info.h"
 #include "build/build_config.h"
 #include "content/common/gpu/gpu_channel.h"
 #include "content/common/gpu/gpu_messages.h"
 #include "content/public/common/content_switches.h"
 #include "ipc/ipc_message_macros.h"
 #include "media/base/limits.h"
 #include "media/base/video_frame.h"
 
 #if defined(OS_CHROMEOS)
 #if defined(ARCH_CPU_ARMEL) || (defined(USE_OZONE) && defined(USE_V4L2_CODEC))
@@ skipping 216 matching lines @@
 GpuVideoEncodeAccelerator::CreateAndroidVEA() {
   scoped_ptr<media::VideoEncodeAccelerator> encoder;
 #if defined(OS_ANDROID) && defined(ENABLE_WEBRTC)
   encoder.reset(new AndroidVideoEncodeAccelerator());
 #endif
   return encoder.Pass();
 }
 
 void GpuVideoEncodeAccelerator::OnEncode(int32 frame_id,
                                          base::SharedMemoryHandle buffer_handle,
+                                         uint32 buffer_offset,
                                          uint32 buffer_size,
                                          bool force_keyframe) {
   DVLOG(3) << "GpuVideoEncodeAccelerator::OnEncode(): frame_id=" << frame_id
            << ", buffer_size=" << buffer_size
            << ", force_keyframe=" << force_keyframe;
   if (!encoder_)
     return;
   if (frame_id < 0) {
     DLOG(ERROR) << "GpuVideoEncodeAccelerator::OnEncode(): invalid frame_id="
                 << frame_id;
     NotifyError(media::VideoEncodeAccelerator::kPlatformFailureError);
     return;
   }
 
+  off_t map_offset = buffer_offset -
+    (buffer_offset % base::SysInfo::VMAllocationGranularity());
+  size_t map_size =  buffer_size + (buffer_offset - map_offset);

[dcheng, 2015/02/02 20:56:23]

This calculation can trivially overflow. buffer_size = 4294963201, buffer_offset
= 4095, assuming 4096 byte pages.

Chrome's IPC tips recommend base/numerics
(http://www.chromium.org/Home/chromium-security/education/security-tips-for-ip...)
to prevent this error from going unnoticed.

[llandwerlin-old, 2015/02/03 16:35:06]

Done.

+
   scoped_ptr<base::SharedMemory> shm(
       new base::SharedMemory(buffer_handle, true));
-  if (!shm->Map(buffer_size)) {
+  if (!shm->MapAt(map_offset, map_size)) {
     DLOG(ERROR) << "GpuVideoEncodeAccelerator::OnEncode(): "
                    "could not map frame_id=" << frame_id;
     NotifyError(media::VideoEncodeAccelerator::kPlatformFailureError);
     return;
   }
 
-  uint8* shm_memory = reinterpret_cast<uint8*>(shm->memory());
+  uint8* shm_memory = reinterpret_cast<uint8*>(shm->memory()) +
+    (buffer_offset - map_offset);
   scoped_refptr<media::VideoFrame> frame =
       media::VideoFrame::WrapExternalPackedMemory(
           input_format_,
           input_coded_size_,
           gfx::Rect(input_visible_size_),
           input_visible_size_,
           shm_memory,
           buffer_size,
           buffer_handle,
+          buffer_offset,

[DaleCurtis, 2015/01/30 18:44:59]

This is unused from now no, no? 

[llandwerlin-old, 2015/01/31 22:42:53]

Yes, once in the gpu process this is unused.
I just put it for consistency.

           base::TimeDelta(),
           // It's turtles all the way down...
           base::Bind(base::IgnoreResult(&base::MessageLoopProxy::PostTask),
                      base::MessageLoopProxy::current(),
                      FROM_HERE,
                      base::Bind(&GpuVideoEncodeAccelerator::EncodeFrameFinished,
                                 weak_this_factory_.GetWeakPtr(),
                                 frame_id,
                                 base::Passed(&shm))));
 
@@ skipping 60 matching lines @@
   stub_->channel()->Send(message);
 }
 
 void GpuVideoEncodeAccelerator::SendCreateEncoderReply(IPC::Message* message,
                                                        bool succeeded) {
   GpuCommandBufferMsg_CreateVideoEncoder::WriteReplyParams(message, succeeded);
   Send(message);
 }
 
 }  // namespace content