ozone: Validate the memory buffer used.

BUG=none

Review-Url: https://codereview.chromium.org/2302053003
Cr-Commit-Position: refs/heads/master@{#416335}

ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.cc

@@ -60,28 +60,31 @@ std::unique_ptr<ClientNativePixmap> ClientNativePixmapDmaBuf::ImportFromDmabuf(
     const gfx::Size& size,
     int stride) {
   DCHECK_GE(dmabuf_fd, 0);
-  return base::WrapUnique(
-      new ClientNativePixmapDmaBuf(dmabuf_fd, size, stride));
+  base::CheckedNumeric<size_t> map_size = stride;
+  map_size *= size.height();
+  if (!map_size.IsValid())
+    return nullptr;
+  return base::WrapUnique(new ClientNativePixmapDmaBuf(dmabuf_fd, size, stride,
+                                                       map_size.ValueOrDie()));
 }
 
 ClientNativePixmapDmaBuf::ClientNativePixmapDmaBuf(int dmabuf_fd,
                                                    const gfx::Size& size,
-                                                   int stride)
-    : dmabuf_fd_(dmabuf_fd), size_(size), stride_(stride) {
+                                                   int stride,
+                                                   size_t map_size)
+    : dmabuf_fd_(dmabuf_fd), map_size_(map_size), size_(size), stride_(stride) {
   TRACE_EVENT0("drm", "ClientNativePixmapDmaBuf");
-  size_t map_size = stride_ * size_.height();
-  data_ = mmap(nullptr, map_size, (PROT_READ | PROT_WRITE), MAP_SHARED,
+  data_ = mmap(nullptr, map_size_, (PROT_READ | PROT_WRITE), MAP_SHARED,
                dmabuf_fd, 0);
   if (data_ == MAP_FAILED) {
     PLOG(ERROR) << "Failed mmap().";
-    base::TerminateBecauseOutOfMemory(map_size);
+    base::TerminateBecauseOutOfMemory(map_size_);
   }
 }
 
 ClientNativePixmapDmaBuf::~ClientNativePixmapDmaBuf() {
   TRACE_EVENT0("drm", "~ClientNativePixmapDmaBuf");
-  size_t size = stride_ * size_.height();
-  int ret = munmap(data_, size);
+  int ret = munmap(data_, map_size_);
   DCHECK(!ret);
 }
 

ui/ozone/platform/drm/common/client_native_pixmap_dmabuf.h

@@ -29,9 +29,13 @@ class ClientNativePixmapDmaBuf : public ClientNativePixmap {
   void GetStride(int* stride) const override;
 
  private:
-  ClientNativePixmapDmaBuf(int dmabuf_fd, const gfx::Size& size, int stride);
+  ClientNativePixmapDmaBuf(int dmabuf_fd,
+                           const gfx::Size& size,
+                           int stride,
+                           size_t map_size);
 
   base::ScopedFD dmabuf_fd_;
+  const size_t map_size_;
   const gfx::Size size_;
   const int stride_;
   void* data_;