#include "content/renderer/renderer_clipboard_client.h"
#include "base/memory/shared_memory.h"
+#include "base/numerics/safe_math.h"
#include "base/strings/string16.h"
#include "content/common/clipboard_messages.h"
#include "content/public/renderer/content_renderer_client.h"
class RendererClipboardWriteContext : public ClipboardClient::WriteContext {
public:
RendererClipboardWriteContext();
- virtual ~RendererClipboardWriteContext();
- virtual void WriteBitmapFromPixels(ui::Clipboard::ObjectMap* objects,
- const void* pixels,
- const gfx::Size& size) OVERRIDE;
- virtual void Flush(const ui::Clipboard::ObjectMap& objects) OVERRIDE;
+ ~RendererClipboardWriteContext() override;
+ void WriteBitmapFromPixels(ui::Clipboard::ObjectMap* objects,
+ const void* pixels,
+ const gfx::Size& size) override;
+ void Flush(const ui::Clipboard::ObjectMap& objects) override;
private:
scoped_ptr<base::SharedMemory> shared_buf_;
if (shared_buf_)
return;
- uint32 buf_size = 4 * size.width() * size.height();
+ base::CheckedNumeric<uint32> checked_buf_size = 4;
+ checked_buf_size *= size.width();
+ checked_buf_size *= size.height();
+ if (!checked_buf_size.IsValid())
+ return;
+
+ uint32 buf_size = checked_buf_size.ValueOrDie();
// Allocate a shared memory buffer to hold the bitmap bits.
shared_buf_.reset(ChildThread::current()->AllocateSharedMemory(buf_size));
bool RendererClipboardClient::IsFormatAvailable(content::ClipboardFormat format,
ui::ClipboardType type) {
- bool result;
+ bool result = false;
RenderThreadImpl::current()->Send(
new ClipboardHostMsg_IsFormatAvailable(format, type, &result));
return result;
void RendererClipboardClient::ReadImage(ui::ClipboardType type,
std::string* data) {
base::SharedMemoryHandle image_handle;
- uint32 image_size;
+ uint32 image_size = 0;
RenderThreadImpl::current()->Send(
new ClipboardHostMsg_ReadImage(type, &image_handle, &image_size));
if (base::SharedMemory::IsHandleValid(image_handle)) {