Add some bounds for gfx ipc deserialization.

BUG=167680

Review URL: https://chromiumcodereview.appspot.com/11617006

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@175496 0039d316-1c4b-4281-b951-d872f2087c98

content/public/common/common_param_traits.cc

@@ -169,6 +169,8 @@ void ParamTraits<gfx::PointF>::Log(const gfx::PointF& v, std::string* l) {
 }
 
 void ParamTraits<gfx::Size>::Write(Message* m, const gfx::Size& p) {
+  DCHECK_GE(p.width(), 0);
+  DCHECK_GE(p.height(), 0);
   m->WriteInt(p.width());
   m->WriteInt(p.height());
 }
@@ -177,8 +179,8 @@ bool ParamTraits<gfx::Size>::Read(const Message* m,
                                   PickleIterator* iter,
                                   gfx::Size* r) {
   int w, h;
-  if (!m->ReadInt(iter, &w) ||
-      !m->ReadInt(iter, &h))
+  if (!m->ReadInt(iter, &w) || w < 0 ||
+      !m->ReadInt(iter, &h) || h < 0)
     return false;
   r->set_width(w);
   r->set_height(h);
@@ -253,25 +255,20 @@ void ParamTraits<gfx::Vector2dF>::Log(const gfx::Vector2dF& v, std::string* l) {
 }
 
 void ParamTraits<gfx::Rect>::Write(Message* m, const gfx::Rect& p) {
-  m->WriteInt(p.x());
-  m->WriteInt(p.y());
-  m->WriteInt(p.width());
-  m->WriteInt(p.height());
+  WriteParam(m, p.origin());
+  WriteParam(m, p.size());
 }
 
 bool ParamTraits<gfx::Rect>::Read(const Message* m,
                                   PickleIterator* iter,
                                   gfx::Rect* r) {
-  int x, y, w, h;
-  if (!m->ReadInt(iter, &x) ||
-      !m->ReadInt(iter, &y) ||
-      !m->ReadInt(iter, &w) ||
-      !m->ReadInt(iter, &h))
+  gfx::Point origin;
+  gfx::Size size;
+  if (!ReadParam(m, iter, &origin) ||
+      !ReadParam(m, iter, &size))
     return false;
-  r->set_x(x);
-  r->set_y(y);
-  r->set_width(w);
-  r->set_height(h);
+  r->set_origin(origin);
+  r->set_size(size);
   return true;
 }