Fix memory problem in DecoderVerbatim

Change from c_str() to data() also did some boundary checks to make there's
no memory error.

BUG=None
TEST=None

Review URL: http://codereview.chromium.org/3388024

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@60746 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 15 insertions, 3 deletions

diff --git a/remoting/base/decoder_verbatim.cc b/remoting/base/decoder_verbatim.cc
index b944bbc..fd0b3d1 100644
--- a/remoting/base/decoder_verbatim.cc
+++ b/remoting/base/decoder_verbatim.cc
@@ -102,7 +102,20 @@ bool DecoderVerbatim::HandleRectData(ChromotingHostMessage* message) {
   // Copy the data line by line.
   const int src_stride = bytes_per_pixel_ * rect_width_;
   const char* src =
-      message->update_stream_packet().rect_data().data().c_str();
+      message->update_stream_packet().rect_data().data().data();
+
+  // Make sure there's enough data in |message|.
+  const int src_size =
+      message->update_stream_packet().rect_data().data().length();
+  if (src_size != src_stride * rect_height_)
+    return false;
+
+  // Make sure there's enough space for us to write to.
+  if (frame_->height() < static_cast<size_t>(rect_height_) ||
+      frame_->stride(media::VideoFrame::kRGBPlane) < src_stride) {
+    return false;
+  }
+
   int src_stride_dir = src_stride;
   if (reverse_rows_) {
     // Copy rows from bottom to top to flip the image vertically.
diff --git a/remoting/base/decoder_verbatim_unittest.cc b/remoting/base/decoder_verbatim_unittest.cc
index 8c00d76..af42e27 100644
--- a/remoting/base/decoder_verbatim_unittest.cc
+++ b/remoting/base/decoder_verbatim_unittest.cc
@@ -33,8 +33,7 @@ TEST(DecoderVerbatimTest, SimpleDecode) {
   begin_rect->set_pixel_format(PixelFormatAscii);
 
   // Prepare the rect data.
-  msg->mutable_update_stream_packet()->mutable_rect_data()->set_data(
-      kData, sizeof(kData));
+  msg->mutable_update_stream_packet()->mutable_rect_data()->set_data(kData);
 
   // Prepare the end rect.
   msg->mutable_update_stream_packet()->mutable_end_rect();