diff --git a/dom/canvas/WebGL2ContextFramebuffers.cpp b/dom/canvas/WebGL2ContextFramebuffers.cpp index bd537d9aeedb..c3460e0f80ba 100644 --- a/dom/canvas/WebGL2ContextFramebuffers.cpp +++ b/dom/canvas/WebGL2ContextFramebuffers.cpp @@ -7,6 +7,7 @@ #include "GLContext.h" #include "GLScreenBuffer.h" +#include "mozilla/CheckedInt.h" #include "WebGLContextUtils.h" #include "WebGLFormats.h" #include "WebGLFramebuffer.h" @@ -38,7 +39,23 @@ WebGL2Context::BlitFramebuffer(GLint srcX0, GLint srcY0, GLint srcX1, GLint srcY return; } - //// + // -- + + const auto fnLikelyOverflow = [](GLint p0, GLint p1) { + auto checked = CheckedInt(p1) - p0; + checked = -checked; // And check the negation! + return !checked.isValid(); + }; + + if (fnLikelyOverflow(srcX0, srcX1) || fnLikelyOverflow(srcY0, srcY1) || + fnLikelyOverflow(dstX0, dstX1) || fnLikelyOverflow(dstY0, dstY1)) + { + ErrorInvalidValue("blitFramebuffer: Likely-to-overflow large ranges are" + " forbidden."); + return; + } + + // -- if (!ValidateAndInitFB("blitFramebuffer: READ_FRAMEBUFFER", mBoundReadFramebuffer) || !ValidateAndInitFB("blitFramebuffer: DRAW_FRAMEBUFFER", mBoundDrawFramebuffer)) diff --git a/dom/canvas/test/webgl-conf/mochitest-errata.ini b/dom/canvas/test/webgl-conf/mochitest-errata.ini index 19e7e51333aa..99569a3bba6d 100644 --- a/dom/canvas/test/webgl-conf/mochitest-errata.ini +++ b/dom/canvas/test/webgl-conf/mochitest-errata.ini @@ -1199,6 +1199,3 @@ skip-if = (os == 'win') skip-if = (os == 'win') [generated/test_2_conformance__textures__misc__tex-video-using-tex-unit-non-zero.html] skip-if = (os == 'win') -[generated/test_2_conformance2__rendering__blitframebuffer-size-overflow.html] -# Bug 1472894 -skip-if = (os == 'win')