OpenHarmony/third_party_mesa3d
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mesa/bufferobj: ensure that very large width+offset are always rejected

Browse Source 
In the case width+offset is triggering an integer overflow, the checks in place
are not working as the comparison will fail.

Cc: mesa-stable

Reviewed-by: Marek Olšák <marek.olsak@amd.com>
Signed-off-by: Corentin Noël <corentin.noel@collabora.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/25909>
(cherry picked from commit e95c9b0515)
This commit is contained in:
Corentin Noël
2023-10-26 12:11:16 +02:00
committed by Eric Engestrom
parent e3bef4dfa3
commit c9040f482e
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.pick_status.json
View File

@@ -1384,7 +1384,7 @@
"description": "mesa/bufferobj: ensure that very large width+offset are always rejected",
"nominated": true,
"nomination_type": 0,
"resolution": 0,
"resolution": 1,
"main_sha": null,
"because_sha": null,
"notes": null

4
src/mesa/main/bufferobj.c
View File

@@ -3373,14 +3373,14 @@ copy_buffer_sub_data(struct gl_context *ctx, struct gl_buffer_object *src,
return;
}
if (readOffset + size > src->Size) {
if (size > src->Size || readOffset > src->Size - size) {
_mesa_error(ctx, GL_INVALID_VALUE,
"%s(readOffset %d + size %d > src_buffer_size %d)", func,
(int) readOffset, (int) size, (int) src->Size);
return;
}
if (writeOffset + size > dst->Size) {
if (size > dst->Size || writeOffset > dst->Size - size) {
_mesa_error(ctx, GL_INVALID_VALUE,
"%s(writeOffset %d + size %d > dst_buffer_size %d)", func,
(int) writeOffset, (int) size, (int) dst->Size);