From 37d6e75fe5a7a5a0352c9d9e09d769fcd6a98d06 Mon Sep 17 00:00:00 2001
From: Bo Liu <[email protected]>
Date: Wed, 03 Jun 2026 14:33:13 -0700
Subject: [PATCH] gpu: Validate IOSurface in MappableBufferIOSurface

MappableBufferIOSurface should validate its IOSurface since it can be
sent from untrusted process to more trusted process; and it can be used
similar to shared memory without involving the "service" side of command
buffer that has the necessary validations.

This change duplicates the validation in
IOSurfaceImageBackingFactory::CreateSharedImageGMBs to
MappableBufferIOSurface::CreateFromHandleImpl, and change the latter to
return null instead of CHECK-ing on failure.

Changes:
* Move SharedImageFormatToIOSurfacePixelFormat to newly created
  gpu/command_buffer/common/iosurface_validation.h because it is needed
  for validation.
* Move validation code from IOSurfaceImageBackingFactory to
  iosurface_validation.h
* Relax the validation to consider RGBA and BGRA the same to avoid
  complexity
* Replace call new validation from MappableBufferIOSurface.

This also effectively reverts the previous bandaid fix that wasn't
really complete: https://chromium-review.googlesource.com/7710673

Bug: 497531791
Change-Id: I85a63f0747a68b0e241f3d2d1e5fb97357cf73e4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7882552
Reviewed-by: Vasiliy Telezhnikov <[email protected]>
Reviewed-by: Dominic Farolino <[email protected]>
Auto-Submit: Bo Liu <[email protected]>
Commit-Queue: Bo Liu <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1641218}
---

diff --git a/components/viz/common/resources/shared_image_format_utils.cc b/components/viz/common/resources/shared_image_format_utils.cc
index 9891b5d5..9966920 100644
--- a/components/viz/common/resources/shared_image_format_utils.cc
+++ b/components/viz/common/resources/shared_image_format_utils.cc
@@ -377,55 +377,4 @@
   return kMappableSharedImageFormats;
 }
 
-#if BUILDFLAG(IS_MAC)
-
-bool MatchesSharedImageFormatWithIOSurfacePixelFormat(
-    const SharedImageFormat& format,
-    OSType io_surface_format,
-    bool override_rgba_to_brga) {
-  switch (io_surface_format) {
-    case kCVPixelFormatType_OneComponent8:
-      return format == SinglePlaneFormat::kR_8;
-    case kCVPixelFormatType_TwoComponent8:
-      return format == SinglePlaneFormat::kRG_88;
-    case kCVPixelFormatType_OneComponent16:
-      return format == SinglePlaneFormat::kR_16;
-    case kCVPixelFormatType_TwoComponent16:
-      return format == SinglePlaneFormat::kRG_1616;
-    case kCVPixelFormatType_ARGB2101010LEPacked:
-      return format == SinglePlaneFormat::kBGRA_1010102;
-    case kCVPixelFormatType_32BGRA:
-      return format == SinglePlaneFormat::kBGRA_8888 ||
-             format == SinglePlaneFormat::kBGRX_8888 ||
-             (override_rgba_to_brga &&
-              (format == SinglePlaneFormat::kRGBA_8888 ||
-               format == SinglePlaneFormat::kRGBX_8888));
-    case kCVPixelFormatType_32RGBA:
-      return format == SinglePlaneFormat::kRGBA_8888 ||
-             format == SinglePlaneFormat::kRGBX_8888;
-    case kCVPixelFormatType_64RGBAHalf:
-      return format == SinglePlaneFormat::kRGBA_F16;
-
-    case kCVPixelFormatType_420YpCbCr8BiPlanarVideoRange:
-      return format == MultiPlaneFormat::kNV12;
-    case kCVPixelFormatType_422YpCbCr8BiPlanarVideoRange:
-      return format == MultiPlaneFormat::kNV16;
-    case kCVPixelFormatType_444YpCbCr8BiPlanarVideoRange:
-      return format == MultiPlaneFormat::kNV24;
-    case kCVPixelFormatType_420YpCbCr8VideoRange_8A_TriPlanar:
-      return format == MultiPlaneFormat::kNV12A;
-    case kCVPixelFormatType_420YpCbCr10BiPlanarVideoRange:
-      return format == MultiPlaneFormat::kP010;
-    case kCVPixelFormatType_422YpCbCr10BiPlanarVideoRange:
-      return format == MultiPlaneFormat::kP210;
-    case kCVPixelFormatType_444YpCbCr10BiPlanarVideoRange:
-      return format == MultiPlaneFormat::kP410;
-    case kCVPixelFormatType_420YpCbCr8Planar:
-      return format == MultiPlaneFormat::kI420;
-  }
-  return false;
-}
-
-#endif  // BUILDFLAG(IS_MAC)
-
 }  // namespace viz
diff --git a/components/viz/common/resources/shared_image_format_utils.h b/components/viz/common/resources/shared_image_format_utils.h
index ba264df..83902bb 100644
--- a/components/viz/common/resources/shared_image_format_utils.h
+++ b/components/viz/common/resources/shared_image_format_utils.h
@@ -6,14 +6,8 @@
 #define COMPONENTS_VIZ_COMMON_RESOURCES_SHARED_IMAGE_FORMAT_UTILS_H_
 
 #include "base/component_export.h"
-#include "build/build_config.h"
 #include "components/viz/common/resources/shared_image_format.h"
 
-#if BUILDFLAG(IS_MAC)
-// Includes `MacTypes.h` for an io surface pixel format, i.e. `OSType`.
-#include <MacTypes.h>
-#endif  // BUILDFLAG(IS_MAC)
-
 enum SkColorType : int;
 
 namespace viz {
@@ -136,16 +130,6 @@
 COMPONENT_EXPORT(VIZ_SHARED_IMAGE_FORMAT)
 base::span<const SharedImageFormat> GetMappableSharedImageFormatForTesting();
 
-#if BUILDFLAG(IS_MAC)
-// Returns whether the given shared image format matches io surface pixel
-// format or not.
-COMPONENT_EXPORT(VIZ_SHARED_IMAGE_FORMAT)
-bool MatchesSharedImageFormatWithIOSurfacePixelFormat(
-    const SharedImageFormat& format,
-    OSType io_surface_format,
-    bool override_rgba_to_brga);
-#endif  // BUILDFLAG(IS_MAC)
-
 }  // namespace viz
 
 #endif  // COMPONENTS_VIZ_COMMON_RESOURCES_SHARED_IMAGE_FORMAT_UTILS_H_
diff --git a/gpu/command_buffer/client/internal/mappable_buffer_io_surface.cc b/gpu/command_buffer/client/internal/mappable_buffer_io_surface.cc
index de2db7f..77e6b415 100644
--- a/gpu/command_buffer/client/internal/mappable_buffer_io_surface.cc
+++ b/gpu/command_buffer/client/internal/mappable_buffer_io_surface.cc
@@ -13,6 +13,7 @@
 #include "base/notimplemented.h"
 #include "base/numerics/safe_conversions.h"
 #include "components/viz/common/resources/shared_image_format_utils.h"
+#include "gpu/command_buffer/common/iosurface_validation.h"
 #include "ui/gfx/mac/io_surface.h"
 
 namespace gpu {
@@ -132,14 +133,12 @@
     return nullptr;
   }
 
-  // TODO(crbug.com/497531791): Check whether IOSurface pixel format matches
-  // the given SharedImageFormat: `format` or not.
-  // Since there is no information about whether `gr_context_type_ ==
-  // GrContextType::kGL` or not, we will treat `override_rgba_to_brga` as always
-  // true. c.f. IOSurfaceImageBackingFactory::CreateSharedImageGMBs().
-  CHECK(viz::MatchesSharedImageFormatWithIOSurfacePixelFormat(
-      format, IOSurfaceGetPixelFormat(handle.io_surface().get()),
-      true /*override_rgba_to_brga*/));
+  std::string validation_error;
+  if (!ValidateIOSurface(handle.io_surface(), format, size,
+                         &validation_error)) {
+    LOG(ERROR) << validation_error;
+    return nullptr;
+  }
 
   int64_t io_surface_width = IOSurfaceGetWidth(handle.io_surface().get());
   int64_t io_surface_height = IOSurfaceGetHeight(handle.io_surface().get());
diff --git a/gpu/command_buffer/common/BUILD.gn b/gpu/command_buffer/common/BUILD.gn
index 2e98429..fad6c570 100644
--- a/gpu/command_buffer/common/BUILD.gn
+++ b/gpu/command_buffer/common/BUILD.gn
@@ -108,6 +108,18 @@
   ]
 
   deps = [ "//base" ]
+
+  if (is_apple) {
+    sources += [
+      "iosurface_validation.cc",
+      "iosurface_validation.h",
+    ]
+
+    frameworks = [
+      "CoreVideo.framework",
+      "IOSurface.framework",
+    ]
+  }
 }
 
 source_set("mailbox_sources") {
diff --git a/gpu/command_buffer/common/iosurface_validation.cc b/gpu/command_buffer/common/iosurface_validation.cc
new file mode 100644
index 0000000..eab41bf4
--- /dev/null
+++ b/gpu/command_buffer/common/iosurface_validation.cc
@@ -0,0 +1,153 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+