Changeset 270160 in webkit

Timestamp:

Nov 22, 2020 12:30:16 AM (20 months ago)

Author:

commit-queue@webkit.org

Message:

Fix getIndexedParameter indexing crash
​https://bugs.webkit.org/show_bug.cgi?id=218601

Patch by Rob Buis <​rbuis@igalia.com> on 2020-11-22
Reviewed by Ryosuke Niwa.

Source/WebCore:

Like in setBoundIndexedTransformFeedbackBuffer ASSERT, the index should
always be smaller than size for indexing to be safe, so bail if the index
is greater than or equal to size.

• html/canvas/WebGLTransformFeedback.cpp:

(WebCore::WebGLTransformFeedback::getBoundIndexedTransformFeedbackBuffer):

LayoutTests:

Add testcase.

• fast/canvas/webgl/getIndexedParameter-crash-expected.txt: Added.
• fast/canvas/webgl/getIndexedParameter-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/canvas/webgl/getIndexedParameter-crash-expected.txt (added)
• LayoutTests/fast/canvas/webgl/getIndexedParameter-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/canvas/WebGLTransformFeedback.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2020-11-22  Rob Buis  <rbuis@igalia.com>
+
+        Fix getIndexedParameter indexing crash
+        https://bugs.webkit.org/show_bug.cgi?id=218601
+
+        Reviewed by Ryosuke Niwa.
+
+        Add testcase.
+
+        * fast/canvas/webgl/getIndexedParameter-crash-expected.txt: Added.
+        * fast/canvas/webgl/getIndexedParameter-crash.html: Added.
+
 2020-11-21  Sihui Liu  <sihui_liu@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-11-22  Rob Buis  <rbuis@igalia.com>
+
+        Fix getIndexedParameter indexing crash
+        https://bugs.webkit.org/show_bug.cgi?id=218601
+
+        Reviewed by Ryosuke Niwa.
+
+        Like in setBoundIndexedTransformFeedbackBuffer ASSERT, the index should
+        always be smaller than size for indexing to be safe, so bail if the index
+        is greater than or equal to size.
+
+        * html/canvas/WebGLTransformFeedback.cpp:
+        (WebCore::WebGLTransformFeedback::getBoundIndexedTransformFeedbackBuffer):
+
 2020-11-21  Ada Chan  <adachan@apple.com>
 

trunk/Source/WebCore/html/canvas/WebGLTransformFeedback.cpp

@@ -77 +77 @@
 bool WebGLTransformFeedback::getBoundIndexedTransformFeedbackBuffer(GCGLuint index, WebGLBuffer** outBuffer)
 {
-    if (index > m_boundIndexedTransformFeedbackBuffers.size())
+    if (index >= m_boundIndexedTransformFeedbackBuffers.size())
         return false;
     *outBuffer = m_boundIndexedTransformFeedbackBuffers[index].get();