Changeset 287807 in webkit

Timestamp:

Jan 7, 2022, 8:09:48 PM (4 years ago)

Author:

Brent Fulgham

Message:

[Hardening] Improve multi draw offset validation
​https://bugs.webkit.org/show_bug.cgi?id=234966
<rdar://problem/86814830>

Reviewed by Darin Adler.

Incorporate draw count into validation of the offset.

• html/canvas/WebGLMultiDraw.cpp:

(WebCore::WebGLMultiDraw::validateOffset):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/canvas/WebGLMultiDraw.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2022-01-07  Brent Fulgham  <bfulgham@apple.com>
+
+        [Hardening] Improve multi draw offset validation
+        https://bugs.webkit.org/show_bug.cgi?id=234966
+        <rdar://problem/86814830>
+
+        Reviewed by Darin Adler.
+
+        Incorporate draw count into validation of the offset.
+
+        * html/canvas/WebGLMultiDraw.cpp:
+        (WebCore::WebGLMultiDraw::validateOffset):
+
 2022-01-07  Myles C. Maxfield  <mmaxfield@apple.com>
 

trunk/Source/WebCore/html/canvas/WebGLMultiDraw.cpp

@@ -136 +136 @@
     }
 
-    if (offset >= static_cast<GCGLuint>(size)) {
+    if (offset >= static_cast<GCGLuint>(size - drawcount)) {
         m_context->synthesizeGLError(GraphicsContextGL::INVALID_OPERATION, functionName, outOfBoundsDescription);
         return false;