Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-13 21:35:39 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1472894 - Forbid too-large ranges in BlitFramebuffer. - r=kvark

Browse Source 
MozReview-Commit-ID: DL0HSrG8wJC

--HG--
extra : rebase_source : 6985e6cc0ca0e33dfe810637d12bad190d20e1a4
This commit is contained in:
jgilbert@mozilla.com 2018-07-02 19:20:47 -07:00
parent 14367430eb
commit 62d2e8890c
2 changed files with 18 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
dom/canvas/WebGL2ContextFramebuffers.cpp
View File

@ -7,6 +7,7 @@
#include "GLContext.h"
#include "GLScreenBuffer.h"
#include "mozilla/CheckedInt.h"
#include "WebGLContextUtils.h"
#include "WebGLFormats.h"
#include "WebGLFramebuffer.h"
@ -38,7 +39,23 @@ WebGL2Context::BlitFramebuffer(GLint srcX0, GLint srcY0, GLint srcX1, GLint srcY
return;
}
////
// --
const auto fnLikelyOverflow = [](GLint p0, GLint p1) {
auto checked = CheckedInt<GLint>(p1) - p0;
checked = -checked; // And check the negation!
return !checked.isValid();
};
if (fnLikelyOverflow(srcX0, srcX1) || fnLikelyOverflow(srcY0, srcY1) ||
fnLikelyOverflow(dstX0, dstX1) || fnLikelyOverflow(dstY0, dstY1))
{
ErrorInvalidValue("blitFramebuffer: Likely-to-overflow large ranges are"
" forbidden.");
return;
}
// --
if (!ValidateAndInitFB("blitFramebuffer: READ_FRAMEBUFFER", mBoundReadFramebuffer) ||
!ValidateAndInitFB("blitFramebuffer: DRAW_FRAMEBUFFER", mBoundDrawFramebuffer))

3
dom/canvas/test/webgl-conf/mochitest-errata.ini
View File

@ -1199,6 +1199,3 @@ skip-if = (os == 'win')
skip-if = (os == 'win')
[generated/test_2_conformance__textures__misc__tex-video-using-tex-unit-non-zero.html]
skip-if = (os == 'win')
[generated/test_2_conformance2__rendering__blitframebuffer-size-overflow.html]
# Bug 1472894
skip-if = (os == 'win')