Changeset 243506 in webkit

Timestamp:

Mar 26, 2019, 11:00:55 AM (7 years ago)

Author:

dino@apple.com

Message:

vertexAttribPointer must restrict offset parameter
​https://bugs.webkit.org/show_bug.cgi?id=196261
<rdar://problem/48458086>

Reviewed by Antoine Quint.

Source/WebCore:

This WebGL function should fail if the offset parameter is
not within [0, max 32-bit int].

Test: fast/canvas/webgl/vertexAttribPointer-with-bad-offset.html

• html/canvas/WebGLRenderingContextBase.cpp:

(WebCore::WebGLRenderingContextBase::vertexAttribPointer):

LayoutTests:

Add a test where the offset parameter is out of bounds.

• fast/canvas/webgl/vertexAttribPointer-with-bad-offset-expected.txt: Added.
• fast/canvas/webgl/vertexAttribPointer-with-bad-offset.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/canvas/webgl/vertexAttribPointer-with-bad-offset-expected.txt (added)
• LayoutTests/fast/canvas/webgl/vertexAttribPointer-with-bad-offset.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2019-03-26  Dean Jackson  <dino@apple.com>
+
+        vertexAttribPointer must restrict offset parameter
+        https://bugs.webkit.org/show_bug.cgi?id=196261
+        <rdar://problem/48458086>
+
+        Reviewed by Antoine Quint.
+
+        Add a test where the offset parameter is out of bounds.
+
+        * fast/canvas/webgl/vertexAttribPointer-with-bad-offset-expected.txt: Added.
+        * fast/canvas/webgl/vertexAttribPointer-with-bad-offset.html: Added.
+
 2019-03-26  Zalan Bujtas  <zalan@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-03-26  Dean Jackson  <dino@apple.com>
+
+        vertexAttribPointer must restrict offset parameter
+        https://bugs.webkit.org/show_bug.cgi?id=196261
+        <rdar://problem/48458086>
+
+        Reviewed by Antoine Quint.
+
+        This WebGL function should fail if the offset parameter is
+        not within [0, max 32-bit int].
+
+        Test: fast/canvas/webgl/vertexAttribPointer-with-bad-offset.html
+
+        * html/canvas/WebGLRenderingContextBase.cpp:
+        (WebCore::WebGLRenderingContextBase::vertexAttribPointer):
+
 2019-03-26  Antoine Quint  <graouts@apple.com>
 

trunk/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp

@@ -5001 +5001 @@
         return;
     }
-    if (size < 1 || size > 4 || stride < 0 || stride > 255 || offset < 0) {
-        synthesizeGLError(GraphicsContext3D::INVALID_VALUE, "vertexAttribPointer", "bad size, stride or offset");
+    if (size < 1 || size > 4) {
+        synthesizeGLError(GraphicsContext3D::INVALID_VALUE, "vertexAttribPointer", "bad size");
+        return;
+    }
+    if (stride < 0 || stride > 255) {
+        synthesizeGLError(GraphicsContext3D::INVALID_VALUE, "vertexAttribPointer", "bad stride");
+        return;
+    }
+    if (offset < 0 || offset > std::numeric_limits<int32_t>::max()) {
+        synthesizeGLError(GraphicsContext3D::INVALID_VALUE, "vertexAttribPointer", "bad offset");
         return;
     }