Pass decoded picture size from VDA to client

media/filters/gpu_video_decoder.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/filters/gpu_video_decoder.h"
 
 #include <algorithm>
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
@@ skipping 404 matching lines @@
 
   PictureBufferMap::iterator it =
       assigned_picture_buffers_.find(picture.picture_buffer_id());
   if (it == assigned_picture_buffers_.end()) {
     NOTREACHED() << "Missing picture buffer: " << picture.picture_buffer_id();
     NotifyError(VideoDecodeAccelerator::PLATFORM_FAILURE);
     return;
   }
   const PictureBuffer& pb = it->second;
 
+  // Validate picture rectangle from GPU. This is for sanity/security check
+  // even the rectangle is not used in this class.
+  if (picture.visible_rect().IsEmpty() ||
+      !gfx::Rect(pb.size()).Contains(picture.visible_rect())) {
+    NOTREACHED() << "Invalid picture size from VDA: "
+                 << picture.visible_rect().ToString() << " should fit in "
+                 << pb.size().ToString();
+    NotifyError(media::VideoDecodeAccelerator::PLATFORM_FAILURE);
+    return;
+  }
+
   // Update frame's timestamp.
   base::TimeDelta timestamp;
+  // Some of the VDAs don't support and thus don't provide us with visible
+  // size in picture.size, passing coded size instead, so always drop it and
+  // use config information instead.
   gfx::Rect visible_rect;
   gfx::Size natural_size;
   GetBufferData(picture.bitstream_buffer_id(), &timestamp, &visible_rect,
                 &natural_size);
   DCHECK(decoder_texture_target_);
 
   scoped_refptr<VideoFrame> frame(VideoFrame::WrapNativeTexture(
       make_scoped_ptr(new gpu::MailboxHolder(
           pb.texture_mailbox(), decoder_texture_target_, 0 /* sync_point */)),
       BindToCurrentLoop(base::Bind(&GpuVideoDecoder::ReleaseMailbox,
@@ skipping 165 matching lines @@
   DLOG(ERROR) << "VDA Error: " << error;
   DestroyVDA();
 }
 
 void GpuVideoDecoder::DCheckGpuVideoAcceleratorFactoriesTaskRunnerIsCurrent()
     const {
   DCHECK(factories_->GetTaskRunner()->BelongsToCurrentThread());
 }
 
 }  // namespace media