Add some limits to incoming audio stream requests to avoid allocating massive

buffers.

BUG=NONE
TEST=NONE

Review URL: http://codereview.chromium.org/147236

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@19586 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 12 insertions, 0 deletions

diff --git a/chrome/browser/renderer_host/audio_renderer_host.cc b/chrome/browser/renderer_host/audio_renderer_host.cc
index 1d2bf07..dbe2e7d 100644
--- a/chrome/browser/renderer_host/audio_renderer_host.cc
+++ b/chrome/browser/renderer_host/audio_renderer_host.cc
@@ -42,6 +42,9 @@ const size_t kMegabytes = 1024 * 1024;
 // renderer to avoid renderer from requesting too much memory.
 const size_t kMaxDecodedPacketSize = 2 * kMegabytes;
 const size_t kMaxBufferCapacity = 5 * kMegabytes;
+static const int kMaxChannels = 32;
+static const int kMaxBitsPerSample = 64;
+static const int kMaxSampleRate = 192000;
 
 }  // namespace
 
@@ -97,6 +100,15 @@ AudioRendererHost::IPCAudioSource*
   if (buffer_capacity < decoded_packet_size)
     return NULL;
 
+  if (channels <= 0 || channels > kMaxChannels)
+    return NULL;
+
+  if (sample_rate <= 0 || sample_rate > kMaxSampleRate)
+    return NULL;
+
+  if (bits_per_sample <= 0 || bits_per_sample > kMaxBitsPerSample)
+    return NULL;
+
   // Create the stream in the first place.
   AudioOutputStream* stream =
       AudioManager::GetAudioManager()->MakeAudioStream(