diff --git a/third_party/blink/renderer/platform/video_capture/video_capture_impl.cc b/third_party/blink/renderer/platform/video_capture/video_capture_impl.cc --- a/third_party/blink/renderer/platform/video_capture/video_capture_impl.cc +++ b/third_party/blink/renderer/platform/video_capture/video_capture_impl.cc @@ -289,6 +289,19 @@ bool VideoCaptureImpl::ProcessBuffer( (media::VideoFrame::NumPlanes( video_frame_init_data.ready_buffer->info->pixel_format) == 3)) << "Currently, only YUV formats support custom strides."; + // Reject strides that are narrower than a row: WrapExternalYuvData() + // does not validate stride >= RowBytes(width), and downstream + // consumers that copy coded_size.width() bytes per row would read + // past the mapped data. + for (size_t plane = 0; plane < 3; ++plane) { + const size_t row_bytes = media::VideoFrame::RowBytes( + plane, video_frame_init_data.ready_buffer->info->pixel_format, + video_frame_init_data.ready_buffer->info->coded_size.width()); + if (video_frame_init_data.ready_buffer->info->strides + ->stride_by_plane[plane] < row_bytes) { + return false; + } + } const size_t y_size = (media::VideoFrame::Rows( media::VideoFrame::Plane::kY,