2 files changed, 12 insertions, 4 deletions
diff --git a/gpu/command_buffer/common/gles2_cmd_utils.cc b/gpu/command_buffer/common/gles2_cmd_utils.cc
index 6b34f39..ee29559 100644
--- a/gpu/command_buffer/common/gles2_cmd_utils.cc
+++ b/gpu/command_buffer/common/gles2_cmd_utils.cc
@@ -10,6 +10,7 @@
 #include <GLES2/gl2ext.h>
 #include <GLES2/gl2extchromium.h>
 
+#include "base/numerics/safe_math.h"
 #include "gpu/command_buffer/common/gles2_cmd_format.h"
 #include "gpu/command_buffer/common/gles2_cmd_utils.h"
 
@@ -770,7 +771,7 @@ bool GLES2Util::ParseUniformName(
     bool* getting_array) {
   bool getting_array_location = false;
   size_t open_pos = std::string::npos;
-  int index = 0;
+  base::CheckedNumeric<int> index = 0;
   if (name[name.size() - 1] == ']') {
     if (name.size() < 3) {
       return false;
@@ -788,10 +789,13 @@ bool GLES2Util::ParseUniformName(
       }
       index = index * 10 + digit;
     }
+    if (!index.IsValid()) {
+      return false;
+    }
     getting_array_location = true;
   }
   *getting_array = getting_array_location;
-  *element_index = index;
+  *element_index = index.ValueOrDie();
   *array_pos = open_pos;
   return true;
 }
diff --git a/gpu/command_buffer/service/program_manager.cc b/gpu/command_buffer/service/program_manager.cc
index f3c447c..1de61bb 100644
--- a/gpu/command_buffer/service/program_manager.cc
+++ b/gpu/command_buffer/service/program_manager.cc
@@ -14,6 +14,7 @@
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/metrics/histogram.h"
+#include "base/numerics/safe_math.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/time/time.h"
@@ -66,7 +67,7 @@ bool GetUniformNameSansElement(
     return false;
   }
 
-  GLint index = 0;
+  base::CheckedNumeric<GLint> index = 0;
   size_t last = name.size() - 1;
   for (size_t pos = open_pos + 1; pos < last; ++pos) {
     int8 digit = name[pos] - '0';
@@ -75,8 +76,11 @@ bool GetUniformNameSansElement(
     }
     index = index * 10 + digit;
   }
+  if (!index.IsValid()) {
+    return false;
+  }
 
-  *element_index = index;
+  *element_index = index.ValueOrDie();
   *new_name = name.substr(0, open_pos);
   return true;
 }