From eb27aad2c1cb9234792b9a92a55c6dc8510d060e Mon Sep 17 00:00:00 2001
From: Jeff Gilbert <jgilbert@mozilla.com>
Date: Mon, 22 May 2017 09:53:23 -0400
Subject: [PATCH] Bug 1357090 - Check that a texture's level_base is not too
 high. r=daoshengmu

MozReview-Commit-ID: 1EKDTrcTacw
---
 dom/canvas/WebGLTexture.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/dom/canvas/WebGLTexture.cpp b/dom/canvas/WebGLTexture.cpp
index 9339f5b04e00..02684bd3a279 100644
--- a/dom/canvas/WebGLTexture.cpp
+++ b/dom/canvas/WebGLTexture.cpp
@@ -314,6 +314,12 @@ WebGLTexture::IsComplete(const char* funcName, uint32_t texUnit,
 {
     *out_initFailed = false;
 
+    const auto maxLevel = kMaxLevelCount - 1;
+    if (mBaseMipmapLevel > maxLevel) {
+        *out_reason = "`level_base` too high.";
+        return false;
+    }
+
     if (!EnsureLevelInitialized(funcName, mBaseMipmapLevel)) {
         *out_initFailed = true;
         return false;