Validate texture sizes given to VDA

content/common/gpu/media/gpu_video_decode_accelerator.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/gpu/media/gpu_video_decode_accelerator.h"
 
 #include <vector>
 
 #include "base/bind.h"
 #include "base/logging.h"
@@ skipping 213 matching lines @@
 
   std::vector<media::PictureBuffer> buffers;
   for (uint32 i = 0; i < buffer_ids.size(); ++i) {
     gpu::gles2::TextureManager::TextureInfo* info =
         texture_manager->GetTextureInfo(texture_ids[i]);
     if (!info) {
       DLOG(FATAL) << "Failed to find texture id " << texture_ids[i];
       NotifyError(media::VideoDecodeAccelerator::INVALID_ARGUMENT);
       return;
     }
+    GLsizei width, height;
+    info->GetLevelSize(0, 0, &width, &height);

[dwkang1, 2013/01/15 08:17:46]

crbug says I don't have permission for 168293. So I leave a comment here.

Could you check this works well in Debug build? It seems that this line leads to
a DCHECK error in texture_manager.cc:37. According to the GetLevelSize() code,
the first argument of this call should be texture target.

[sheu, 2013/01/15 08:25:38]

It looks like you're right; I'll have to follow-up on this CL.  It turns out the
"face" argument isn't "face index", but "face target": 

http://code.google.com/searchframe#OAMlx_jo-ck/src/gpu/command_buffer/service...

Behavior is still correct in release build; we hit a NOTREACHED(), but default
to 0, which is what we want.  Still need to fix though.

+    if (width != sizes[i].width() || height != sizes[i].height()) {
+      DLOG(FATAL) << "Size mismatch for texture id " << texture_ids[i];
+      NotifyError(media::VideoDecodeAccelerator::INVALID_ARGUMENT);
+      return;
+    }
     if (!texture_manager->ClearRenderableLevels(command_decoder, info)) {
       DLOG(FATAL) << "Failed to Clear texture id " << texture_ids[i];
       NotifyError(media::VideoDecodeAccelerator::PLATFORM_FAILURE);
       return;
     }
     uint32 service_texture_id;
     if (!command_decoder->GetServiceTextureId(
             texture_ids[i], &service_texture_id)) {
       DLOG(FATAL) << "Failed to translate texture!";
       NotifyError(media::VideoDecodeAccelerator::PLATFORM_FAILURE);
@@ skipping 63 matching lines @@
     stub_.reset();
   }
 }
 
 bool GpuVideoDecodeAccelerator::Send(IPC::Message* message) {
   DCHECK(sender_);
   return sender_->Send(message);
 }
 
 }  // namespace content