[M149] Fix OOB write in RotateDesktopFrame and DXGI size mismatch Original change's description: > Fix OOB write in RotateDesktopFrame and DXGI size mismatch > > Upgrade RTC_DCHECK to RTC_CHECK in RotateDesktopFrame to enforce > bounds checks in release builds. Validate captured frame size against > expected unrotated size in DxgiOutputDuplicator::Duplicate to fail > gracefully on resolution changes. > > Fixed: chromium:520199394 > Change-Id: Iad22c89cf3ef900b0ac58a72ec3a9f8d2e96123b > Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/479000 > Auto-Submit: Alexander Cooper <alcooper@chromium.org> > Commit-Queue: Alexander Cooper <alcooper@chromium.org> > Reviewed-by: Mark Foltz <mfoltz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#47937} (cherry picked from commit 15644107234aa9bc7a4bf7e9f9a2157a8a9415b4) Bug: chromium:522134600,chromium:520199394 Change-Id: Iad22c89cf3ef900b0ac58a72ec3a9f8d2e96123b Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/480600 Commit-Queue: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com> Bot-Commit: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com> Auto-Submit: Chrome Cherry Picker <chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/branch-heads/7827@{#7} Cr-Branched-From: d606bc991592fbf4dcbe85e9d05db5e501a5ad42-refs/heads/main@{#47595}
diff --git a/modules/desktop_capture/desktop_frame_rotation.cc b/modules/desktop_capture/desktop_frame_rotation.cc index a6b4d16..a7ea388 100644 --- a/modules/desktop_capture/desktop_frame_rotation.cc +++ b/modules/desktop_capture/desktop_frame_rotation.cc
@@ -99,13 +99,13 @@ const DesktopVector& target_offset, DesktopFrame* target) { RTC_DCHECK(target); - RTC_DCHECK(DesktopRect::MakeSize(source.size()).ContainsRect(source_rect)); + RTC_CHECK(DesktopRect::MakeSize(source.size()).ContainsRect(source_rect)); // TODO(bugs.webrtc.org/436974448): Support other pixel formats. RTC_CHECK_EQ(FOURCC_ARGB, source.pixel_format()); // The rectangle in `target`. const DesktopRect target_rect = RotateAndOffsetRect(source_rect, source.size(), rotation, target_offset); - RTC_DCHECK(DesktopRect::MakeSize(target->size()).ContainsRect(target_rect)); + RTC_CHECK(DesktopRect::MakeSize(target->size()).ContainsRect(target_rect)); if (target_rect.is_empty()) { return;
diff --git a/modules/desktop_capture/win/dxgi_output_duplicator.cc b/modules/desktop_capture/win/dxgi_output_duplicator.cc index f07a55a..946401a 100644 --- a/modules/desktop_capture/win/dxgi_output_duplicator.cc +++ b/modules/desktop_capture/win/dxgi_output_duplicator.cc
@@ -229,6 +229,19 @@ // triggers screen flickering? const DesktopFrame& source = texture_->AsDesktopFrame(); + // During a resolution transition, DXGI might deliver a frame with the new + // size before the controller detects the change and reinitializes. + // `unrotated_size_` is cached at initialization and only updated when + // this object is recreated. We abort capture on mismatch to force + // reinitialization by the |DxgiDuplicatorController|. + if (!source.size().equals(unrotated_size_)) { + RTC_LOG(LS_WARNING) << "Captured frame size " << source.size().width() + << "x" << source.size().height() + << " does not match expected size " + << unrotated_size_.width() << "x" + << unrotated_size_.height(); + return false; + } if (rotation_ != Rotation::CLOCK_WISE_0) { for (DesktopRegion::Iterator it(updated_region); !it.IsAtEnd(); it.Advance()) {