Commit 19770a66 authored by bbudge@chromium.org's avatar bbudge@chromium.org

Pepper: Make sure 'out' params are initialized for all code paths.

Change PPB_ImageData_Proxy and PPB_Instance_Proxy to always initialize
'out' params, to avoid sending uninitialized memory from renderer to
plugin.

BUG=391023

Review URL: https://codereview.chromium.org/383143003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@282692 0039d316-1c4b-4281-b951-d872f2087c98
parent 92c35992
......@@ -494,9 +494,7 @@ PP_Resource PPB_ImageData_Proxy::CreateProxyResource(
}
HostResource result;
// Initialize desc so we don't send unitialized memory over IPC.
// https://crbug.com/391023.
PP_ImageDataDesc desc = {};
PP_ImageDataDesc desc;
switch (type) {
case PPB_ImageData_Shared::SIMPLE: {
ppapi::proxy::SerializedHandle image_handle_wrapper;
......@@ -622,6 +620,9 @@ void PPB_ImageData_Proxy::OnHostMsgCreatePlatform(
HostResource* result,
PP_ImageDataDesc* desc,
ImageHandle* result_image_handle) {
// Clear |desc| so we don't send unitialized memory to the plugin.
// https://crbug.com/391023.
*desc = PP_ImageDataDesc();
IPC::PlatformFileForTransit image_handle;
uint32_t byte_count;
PP_Resource resource =
......@@ -647,6 +648,9 @@ void PPB_ImageData_Proxy::OnHostMsgCreateSimple(
HostResource* result,
PP_ImageDataDesc* desc,
ppapi::proxy::SerializedHandle* result_image_handle) {
// Clear |desc| so we don't send unitialized memory to the plugin.
// https://crbug.com/391023.
*desc = PP_ImageDataDesc();
IPC::PlatformFileForTransit image_handle;
uint32_t byte_count;
PP_Resource resource =
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment