tree fb621e3867db1074973f415f0cc70caf6478e3f5
parent 88329b9266a34bfb78a619d7cbf678da5e293f98
author Joe Downing <joedow@google.com> 1602864921 -0700
committer Commit Bot <commit-bot@chromium.org> 1602873104 +0000

Fixing ASAN container-overflow error in DxgiOutputDuplicator

The DxgiOutputDuplicator uses a vector<byte> to hold the rects
that have changed on the screen.  It then iterates over the
vector to grab each rect and apply it to the updated_region.

There is vector resizing logic which checks the 'capacity' of
the vector and determines whether there is enough space for the
changed rect data.  Often the 'capacity' and 'size' of the
vector are equal but that isn't always true.  When the capacity
is greater than size, and the number of changed rects is high
enough, rect data will be written past the element pointed to
by (data() + size()) and this is the error that ASAN is warning
of.

The fix is to use size() instead of capacity() when determining
whether to resize the vector and as the buffer size we provide
to the Windows API.  There are no other usages of this vector so
there aren't any problems caused by the size/capacity discrepancy
in the existing builds.  The ASAN issue is worth fixing in case
someone comes along and decides to use the vector differently (e.g
rely on the size instead of capacity so some of the rects are
not counted).

Bug: chromium:1138446
Change-Id: I3041091423de889e0f8aabc56ece9466a3000b4f
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/188900
Reviewed-by: Jamie Walch <jamiewalch@chromium.org>
Commit-Queue: Joe Downing <joedow@google.com>
Cr-Commit-Position: refs/heads/master@{#32425}