Enforce non-negative BitstreamBuffer id

content/common/gpu/media/gpu_video_decode_accelerator.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/gpu/media/gpu_video_decode_accelerator.h"
 
 #include <vector>
 
 #include "base/bind.h"
 #include "base/logging.h"
@@ skipping 187 matching lines @@
   return;
 #endif
 
   if (!video_decode_accelerator_->Initialize(profile))
     NotifyError(media::VideoDecodeAccelerator::PLATFORM_FAILURE);
 }
 
 void GpuVideoDecodeAccelerator::OnDecode(
     base::SharedMemoryHandle handle, int32 id, uint32 size) {
   DCHECK(video_decode_accelerator_.get());
+  if (id < 0) {
+    DLOG(FATAL) << "BitstreamBuffer id " << id << " out of range";
+    NotifyError(media::VideoDecodeAccelerator::INVALID_ARGUMENT);
+    return;
+  }
   video_decode_accelerator_->Decode(media::BitstreamBuffer(id, handle, size));
 }
 
 void GpuVideoDecodeAccelerator::OnAssignPictureBuffers(
       const std::vector<int32>& buffer_ids,
       const std::vector<uint32>& texture_ids,
       const std::vector<gfx::Size>& sizes) {
   if (buffer_ids.size() != texture_ids.size() ||
       buffer_ids.size() != sizes.size()) {
     NotifyError(media::VideoDecodeAccelerator::INVALID_ARGUMENT);
     return;
   }
 
   gpu::gles2::GLES2Decoder* command_decoder = stub_->decoder();
   gpu::gles2::TextureManager* texture_manager =
       command_decoder->GetContextGroup()->texture_manager();
 
   std::vector<media::PictureBuffer> buffers;
   for (uint32 i = 0; i < buffer_ids.size(); ++i) {
+    if (buffer_ids[i] < 0) {
+      DLOG(FATAL) << "Buffer id " << buffer_ids[i] << " out of range";
+      NotifyError(media::VideoDecodeAccelerator::INVALID_ARGUMENT);
+      return;
+    }
     gpu::gles2::TextureManager::TextureInfo* info =
         texture_manager->GetTextureInfo(texture_ids[i]);
     if (!info) {
       DLOG(FATAL) << "Failed to find texture id " << texture_ids[i];
       NotifyError(media::VideoDecodeAccelerator::INVALID_ARGUMENT);
       return;
     }
     GLsizei width, height;
     info->GetLevelSize(0, 0, &width, &height);
     if (width != sizes[i].width() || height != sizes[i].height()) {
@@ skipping 77 matching lines @@
     stub_.reset();
   }
 }
 
 bool GpuVideoDecodeAccelerator::Send(IPC::Message* message) {
   DCHECK(sender_);
   return sender_->Send(message);
 }
 
 }  // namespace content