Code: void WebGraphicsContext3DCommandBufferImpl::reshape(int width, int height) {
  cached_width_ = width;
   cached_height_ = height;
 
   gl_->ResizeCHROMIUM(width, height);
#ifdef FLIP_FRAMEBUFFER_VERTICALLY
  scanline_.reset(new uint8[width * 4]);
#endif  // FLIP_FRAMEBUFFER_VERTICALLY
 }

Vulnerability Type: DoS Overflow Mem. Corr. 
CWE ID: CWE-119
Summary: The WebGL implementation in Google Chrome before 17.0.963.83 does not properly handle CANVAS elements, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
Commit Message: Fix mismanagement in handling of temporary scanline for vertical flip.

BUG=116637
TEST=manual test from bug report with ASAN

Review URL: https://chromiumcodereview.appspot.com/9617038

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@125301 0039d316-1c4b-4281-b951-d872f2087c98