media: VideoFrame: add offset for shared memory buffers

content/common/gpu/media/gpu_video_encode_accelerator.cc

Index: content/common/gpu/media/gpu_video_encode_accelerator.cc
diff --git a/content/common/gpu/media/gpu_video_encode_accelerator.cc b/content/common/gpu/media/gpu_video_encode_accelerator.cc
index df16d97839ac9b14e8a407ce06d25622df1e873b..2563ce37f519f9136cc4601b6241114045daf6d2 100644
--- a/content/common/gpu/media/gpu_video_encode_accelerator.cc
+++ b/content/common/gpu/media/gpu_video_encode_accelerator.cc
@@ -9,6 +9,7 @@
 #include "base/logging.h"
 #include "base/memory/shared_memory.h"
 #include "base/message_loop/message_loop_proxy.h"
+#include "base/sys_info.h"
 #include "build/build_config.h"
 #include "content/common/gpu/gpu_channel.h"
 #include "content/common/gpu/gpu_messages.h"
@@ -245,6 +246,7 @@ GpuVideoEncodeAccelerator::CreateAndroidVEA() {
 
 void GpuVideoEncodeAccelerator::OnEncode(int32 frame_id,
                                          base::SharedMemoryHandle buffer_handle,
+                                         uint32 buffer_offset,
                                          uint32 buffer_size,
                                          bool force_keyframe) {
   DVLOG(3) << "GpuVideoEncodeAccelerator::OnEncode(): frame_id=" << frame_id
@@ -259,16 +261,21 @@ void GpuVideoEncodeAccelerator::OnEncode(int32 frame_id,
     return;
   }
 
+  off_t map_offset = buffer_offset -
+    (buffer_offset % base::SysInfo::VMAllocationGranularity());
+  size_t map_size =  buffer_size + (buffer_offset - map_offset);

[dcheng, 2015/02/02 20:56:23]

This calculation can trivially overflow. buffer_size = 4294963201, buffer_offset
= 4095, assuming 4096 byte pages.

Chrome's IPC tips recommend base/numerics
(http://www.chromium.org/Home/chromium-security/education/security-tips-for-ip...)
to prevent this error from going unnoticed.

[llandwerlin-old, 2015/02/03 16:35:06]

Done.

+
   scoped_ptr<base::SharedMemory> shm(
       new base::SharedMemory(buffer_handle, true));
-  if (!shm->Map(buffer_size)) {
+  if (!shm->MapAt(map_offset, map_size)) {
     DLOG(ERROR) << "GpuVideoEncodeAccelerator::OnEncode(): "
                    "could not map frame_id=" << frame_id;
     NotifyError(media::VideoEncodeAccelerator::kPlatformFailureError);
     return;
   }
 
-  uint8* shm_memory = reinterpret_cast<uint8*>(shm->memory());
+  uint8* shm_memory = reinterpret_cast<uint8*>(shm->memory()) +
+    (buffer_offset - map_offset);
   scoped_refptr<media::VideoFrame> frame =
       media::VideoFrame::WrapExternalPackedMemory(
           input_format_,
@@ -278,6 +285,7 @@ void GpuVideoEncodeAccelerator::OnEncode(int32 frame_id,
           shm_memory,
           buffer_size,
           buffer_handle,
+          buffer_offset,

[DaleCurtis, 2015/01/30 18:44:59]

This is unused from now no, no? 

[llandwerlin-old, 2015/01/31 22:42:53]

Yes, once in the gpu process this is unused.
I just put it for consistency.

           base::TimeDelta(),
           // It's turtles all the way down...
           base::Bind(base::IgnoreResult(&base::MessageLoopProxy::PostTask),