wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 1190526 - Check for overflow in vertex allocation. r=jrmuizel

Browse Source
This commit is contained in:
Kyle 2015-08-17 11:31:17 -04:00
parent 57e1452704
commit 6aab8c3440
1 changed files with 13 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
gfx/angle/src/libGLESv2/renderer/d3d/VertexBuffer.cpp
View File

@ -101,7 +101,12 @@ gl::Error VertexBufferInterface::storeVertexAttributes(const gl::VertexAttribute
return error;
}
if (mWritePosition + spaceRequired < mWritePosition)
// Align to 16-byte boundary
unsigned int alignedSpaceRequired = roundUp(spaceRequired, 16u);
// Protect against integer overflow
if (!IsUnsignedAdditionSafe(mWritePosition, alignedSpaceRequired) ||
alignedSpaceRequired < spaceRequired)
{
return gl::Error(GL_OUT_OF_MEMORY, "Internal error, new vertex buffer write position would overflow.");
}
@ -124,10 +129,7 @@ gl::Error VertexBufferInterface::storeVertexAttributes(const gl::VertexAttribute
*outStreamOffset = mWritePosition;
}
mWritePosition += spaceRequired;
// Align to 16-byte boundary
mWritePosition = rx::roundUp(mWritePosition, 16u);
mWritePosition += alignedSpaceRequired;
return gl::Error(GL_NO_ERROR);
}
@ -143,17 +145,18 @@ gl::Error VertexBufferInterface::reserveVertexSpace(const gl::VertexAttribute &a
return error;
}
// Align to 16-byte boundary
unsigned int alignedRequiredSpace = roundUp(requiredSpace, 16u);
// Protect against integer overflow
if (mReservedSpace + requiredSpace < mReservedSpace)
if (!IsUnsignedAdditionSafe(mReservedSpace, alignedRequiredSpace) ||
alignedRequiredSpace < requiredSpace)
{
return gl::Error(GL_OUT_OF_MEMORY, "Unable to reserve %u extra bytes in internal vertex buffer, "
"it would result in an overflow.", requiredSpace);
}
mReservedSpace += requiredSpace;
// Align to 16-byte boundary
mReservedSpace = rx::roundUp(mReservedSpace, 16u);
mReservedSpace += alignedRequiredSpace;
return gl::Error(GL_NO_ERROR);
}