Reject CompositorFrames with no render passes when deserializing

cc/ipc/cc_param_traits.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "cc/ipc/cc_param_traits.h"
 
 #include <stddef.h>
 #include <utility>
 
 #include "base/numerics/safe_conversions.h"
@@ skipping 777 matching lines @@
     return false;
 
   const size_t kMaxRenderPasses = 10000;
   const size_t kMaxSharedQuadStateListSize = 100000;
   const size_t kMaxQuadListSize = 1000000;
 
   std::set<int> pass_id_set;
 
   uint32_t num_render_passes;
   if (!ReadParam(m, iter, &p->resource_list) ||
-      !ReadParam(m, iter, &num_render_passes) ||
+      !ReadParam(m, iter, &num_render_passes) || num_render_passes == 0 ||
       num_render_passes > kMaxRenderPasses)
     return false;
   for (uint32_t i = 0; i < num_render_passes; ++i) {
     uint32_t quad_list_size;
     uint32_t shared_quad_state_list_size;
     if (!ReadParam(m, iter, &quad_list_size) ||
         !ReadParam(m, iter, &shared_quad_state_list_size) ||
         quad_list_size > kMaxQuadListSize ||
         shared_quad_state_list_size > kMaxSharedQuadStateListSize)
       return false;
@@ skipping 173 matching lines @@
 #undef CC_IPC_CC_PARAM_TRAITS_MACROS_H_
 #include "cc/ipc/cc_param_traits_macros.h"
 }  // namespace IPC
 
 // Generate param traits log methods.
 #include "ipc/param_traits_log_macros.h"
 namespace IPC {
 #undef CC_IPC_CC_PARAM_TRAITS_MACROS_H_
 #include "cc/ipc/cc_param_traits_macros.h"
 }  // namespace IPC