Code: void SystemClipboard::WriteImage(Image* image,
                                 const KURL& url,
                                 const String& title) {
  DCHECK(image);

  PaintImage paint_image = image->PaintImageForCurrentFrame();
  SkBitmap bitmap;
  if (sk_sp<SkImage> sk_image = paint_image.GetSkImage())
    sk_image->asLegacyBitmap(&bitmap);
   if (bitmap.isNull())
     return;
 
  if (!bitmap.getPixels())
    return;
 
   clipboard_->WriteImage(mojom::ClipboardBuffer::kStandard, bitmap);
 
  if (url.IsValid() && !url.IsEmpty()) {
#if !defined(OS_MACOSX)
    clipboard_->WriteBookmark(mojom::ClipboardBuffer::kStandard,
                              url.GetString(), NonNullString(title));
#endif

    clipboard_->WriteHtml(mojom::ClipboardBuffer::kStandard,
                          URLToImageMarkup(url, title), KURL());
  }
  clipboard_->CommitWrite(mojom::ClipboardBuffer::kStandard);
}

Vulnerability Type: DoS Overflow 
CWE ID: CWE-119
Summary: Buffer overflow in the clipboard implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger unexpected bitmap data, related to content/renderer/renderer_clipboard_client.cc and content/renderer/webclipboard_impl.cc.
Commit Message: System Clipboard: Remove extraneous check for bitmap.getPixels()

Bug 369621 originally led to this check being introduced via
https://codereview.chromium.org/289573002/patch/40001/50002, but after
https://crrev.com/c/1345809, I'm not sure that it's still necessary.

This change succeeds when tested against the "minimized test case" provided in
crbug.com/369621 's description, but I'm unsure how to make the minimized test
case fail, so this doesn't prove that the change would succeed against the
fuzzer's test case (which originally filed the bug).

As I'm unable to view the relevant fuzzer test case, (see crbug.com/918705),
I don't know exactly what may have caused the fuzzer to fail. Therefore,
I've added a CHECK for the time being, so that we will be notified in canary
if my assumption was incorrect.

Bug: 369621
Change-Id: Ie9b47a4b38ba1ed47624de776015728e541d27f7
Reviewed-on: https://chromium-review.googlesource.com/c/1393436
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Reviewed-by: Kai Ninomiya <kainino@chromium.org>
Reviewed-by: Victor Costan <pwnall@chromium.org>
Commit-Queue: Victor Costan <pwnall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#619591}