Command injection

The AsyncPixelTransfersCompletedQuery::End function in gpu/commandbuffer/service/querymanager.cc in Google Chrome, as used in Google Chrome OS before 33.0.1750.152, does not check whether a certain position is within the bounds of a shared-memory segment, which allows remote attackers to cause a...