diff --git a/services/viz/public/cpp/compositing/bitmap_in_shared_memory_mojom_traits.cc b/services/viz/public/cpp/compositing/bitmap_in_shared_memory_mojom_traits.cc index aac9ee18fb5c96ae6518c4d99e619f56787b8e17..9ff3e3120fde2672609575544ddbe285213d659d 100644 --- a/services/viz/public/cpp/compositing/bitmap_in_shared_memory_mojom_traits.cc +++ b/services/viz/public/cpp/compositing/bitmap_in_shared_memory_mojom_traits.cc @@ -76,6 +76,10 @@ bool StructTraits::Read( if (!mapping_ptr->IsValid()) return false; + if (mapping_ptr->size() < image_info.computeByteSize(data.row_bytes())) { + return false; + } + if (!sk_bitmap->installPixels(image_info, mapping_ptr->memory(), data.row_bytes(), &DeleteSharedMemoryMapping, mapping_ptr.get())) {