Changeset 265401 in webkit

Timestamp:

Aug 7, 2020 5:31:25 PM (4 years ago)

Author:

commit-queue@webkit.org

Message:

[WebGL2] Missing validation for sampler unit index
​https://bugs.webkit.org/show_bug.cgi?id=215303

Patch by James Darpinian <James Darpinian> on 2020-08-07
Reviewed by Dean Jackson.

Test: webgl/2.0.0/deqp/functional/gles3/negativeshaderapi.html

• html/canvas/WebGL2RenderingContext.cpp:

(WebCore::WebGL2RenderingContext::bindSampler):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• html/canvas/WebGL2RenderingContext.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-08-07  James Darpinian  <jdarpinian@chromium.org>
+
+        [WebGL2] Missing validation for sampler unit index
+        https://bugs.webkit.org/show_bug.cgi?id=215303
+
+        Reviewed by Dean Jackson.
+
+        Test: webgl/2.0.0/deqp/functional/gles3/negativeshaderapi.html
+
+        * html/canvas/WebGL2RenderingContext.cpp:
+        (WebCore::WebGL2RenderingContext::bindSampler):
+
 2020-08-07  James Darpinian  <jdarpinian@chromium.org>
 

trunk/Source/WebCore/html/canvas/WebGL2RenderingContext.cpp

@@ -1988 +1988 @@
 void WebGL2RenderingContext::bindSampler(GCGLuint unit, WebGLSampler* sampler)
 {
-    if (isContextLostOrPending() || m_boundSamplers[unit] == sampler)
-        return;
+    if (isContextLostOrPending())
+        return;
+    
+    if (unit >= m_boundSamplers.size()) {
+        synthesizeGLError(GraphicsContextGL::INVALID_VALUE, "bindSampler", "invalid texture unit");
+        return;
+    }
 
     if (sampler && sampler->isDeleted()) {
@@ -1996 +2001 @@
     }
 
+    if (m_boundSamplers[unit] == sampler)
+        return;
     m_context->bindSampler(unit, objectOrZero(sampler));
     m_boundSamplers[unit] = sampler;