Commit 35ab4d76 authored by sadrul's avatar sadrul Committed by Commit bot

ozone: Validate the memory buffer used.

BUG=none

Review-Url: https://codereview.chromium.org/2302053003
Cr-Commit-Position: refs/heads/master@{#416335}
parent e4546d22
......@@ -60,28 +60,31 @@ std::unique_ptr<ClientNativePixmap> ClientNativePixmapDmaBuf::ImportFromDmabuf(
const gfx::Size& size,
int stride) {
DCHECK_GE(dmabuf_fd, 0);
return base::WrapUnique(
new ClientNativePixmapDmaBuf(dmabuf_fd, size, stride));
base::CheckedNumeric<size_t> map_size = stride;
map_size *= size.height();
if (!map_size.IsValid())
return nullptr;
return base::WrapUnique(new ClientNativePixmapDmaBuf(dmabuf_fd, size, stride,
map_size.ValueOrDie()));
}
ClientNativePixmapDmaBuf::ClientNativePixmapDmaBuf(int dmabuf_fd,
const gfx::Size& size,
int stride)
: dmabuf_fd_(dmabuf_fd), size_(size), stride_(stride) {
int stride,
size_t map_size)
: dmabuf_fd_(dmabuf_fd), map_size_(map_size), size_(size), stride_(stride) {
TRACE_EVENT0("drm", "ClientNativePixmapDmaBuf");
size_t map_size = stride_ * size_.height();
data_ = mmap(nullptr, map_size, (PROT_READ | PROT_WRITE), MAP_SHARED,
data_ = mmap(nullptr, map_size_, (PROT_READ | PROT_WRITE), MAP_SHARED,
dmabuf_fd, 0);
if (data_ == MAP_FAILED) {
PLOG(ERROR) << "Failed mmap().";
base::TerminateBecauseOutOfMemory(map_size);
base::TerminateBecauseOutOfMemory(map_size_);
}
}
ClientNativePixmapDmaBuf::~ClientNativePixmapDmaBuf() {
TRACE_EVENT0("drm", "~ClientNativePixmapDmaBuf");
size_t size = stride_ * size_.height();
int ret = munmap(data_, size);
int ret = munmap(data_, map_size_);
DCHECK(!ret);
}
......
......@@ -29,9 +29,13 @@ class ClientNativePixmapDmaBuf : public ClientNativePixmap {
void GetStride(int* stride) const override;
private:
ClientNativePixmapDmaBuf(int dmabuf_fd, const gfx::Size& size, int stride);
ClientNativePixmapDmaBuf(int dmabuf_fd,
const gfx::Size& size,
int stride,
size_t map_size);
base::ScopedFD dmabuf_fd_;
const size_t map_size_;
const gfx::Size size_;
const int stride_;
void* data_;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment