diff options
| author | sheu@chromium.org <sheu@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-01-04 04:44:31 +0000 |
|---|---|---|
| committer | sheu@chromium.org <sheu@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-01-04 04:44:31 +0000 |
| commit | 1b01fae4d9fb0b334e563e0596e105bf2dd437d9 (patch) | |
| tree | ff80f404b8f7fb1d66110f612e66d47718c700f3 /content | |
| parent | 1927839292e388e250657c903d2eee784d192408 (diff) | |
| download | chromium_src-1b01fae4d9fb0b334e563e0596e105bf2dd437d9.zip chromium_src-1b01fae4d9fb0b334e563e0596e105bf2dd437d9.tar.gz chromium_src-1b01fae4d9fb0b334e563e0596e105bf2dd437d9.tar.bz2 | |
Validate texture sizes given to VDA
Make sure that the texture sizes as passed from the untrusted renderer to the
to the VDA on the GPU process match with the texture's size as the GPU
process has tracked it.
BUG=chromium:168293
TEST=local build, run on x86, snow
Review URL: https://chromiumcodereview.appspot.com/11722023
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@175101 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'content')
| -rw-r--r-- | content/common/gpu/media/gpu_video_decode_accelerator.cc | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/content/common/gpu/media/gpu_video_decode_accelerator.cc b/content/common/gpu/media/gpu_video_decode_accelerator.cc index 7e76095..e6b1f85 100644 --- a/content/common/gpu/media/gpu_video_decode_accelerator.cc +++ b/content/common/gpu/media/gpu_video_decode_accelerator.cc @@ -231,6 +231,13 @@ void GpuVideoDecodeAccelerator::OnAssignPictureBuffers( NotifyError(media::VideoDecodeAccelerator::INVALID_ARGUMENT); return; } + GLsizei width, height; + info->GetLevelSize(0, 0, &width, &height); + if (width != sizes[i].width() || height != sizes[i].height()) { + DLOG(FATAL) << "Size mismatch for texture id " << texture_ids[i]; + NotifyError(media::VideoDecodeAccelerator::INVALID_ARGUMENT); + return; + } if (!texture_manager->ClearRenderableLevels(command_decoder, info)) { DLOG(FATAL) << "Failed to Clear texture id " << texture_ids[i]; NotifyError(media::VideoDecodeAccelerator::PLATFORM_FAILURE); |