Changeset 57559 in webkit


Ignore:
Timestamp:
Apr 13, 2010 10:29:23 PM (14 years ago)
Author:
eric@webkit.org
Message:

2010-04-13 Zhenyao Mo <​zmo@google.com>

Reviewed by Oliver Hunt.

Fix a potential integer overflow in WebGL*Array::slice()
​https://bugs.webkit.org/show_bug.cgi?id=37466

  • fast/canvas/webgl/array-unit-tests-expected.txt: Add tests that would cause overflow without this fix, but work fine with this fix.
  • fast/canvas/webgl/array-unit-tests.html: Ditto.

2010-04-13 Zhenyao Mo <​zmo@google.com>

Reviewed by Oliver Hunt.

Fix a potential integer overflow in WebGL*Array::slice()
​https://bugs.webkit.org/show_bug.cgi?id=37466

  • html/canvas/WebGLArray.h: (WebCore::WebGLArray::clampOffsetAndNumElements): Input parameter "offset"'s semantic changed from in bytes from buffer to in elements from array view; calculate offset in bytes from buffer inside the function, avoiding overflow.
  • html/canvas/WebGLByteArray.cpp: (WebCore::WebGLByteArray::slice): Changed according to new semantic of WebCore::WebGLArray::clampOffsetAndNumElements.
  • html/canvas/WebGLFloatArray.cpp: (WebCore::WebGLFloatArray::slice): Ditto.
  • html/canvas/WebGLIntArray.cpp: (WebCore::WebGLIntArray::slice): Ditto.
  • html/canvas/WebGLShortArray.cpp: (WebCore::WebGLShortArray::slice): Ditto.
  • html/canvas/WebGLUnsignedByteArray.cpp: (WebCore::WebGLUnsignedByteArray::slice): Ditto.
  • html/canvas/WebGLUnsignedIntArray.cpp: (WebCore::WebGLUnsignedIntArray::slice): Ditto.
  • html/canvas/WebGLUnsignedShortArray.cpp: (WebCore::WebGLUnsignedShortArray::slice): Ditto.
Location:
trunk
Files:
12 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r57558 r57559  
     12010-04-13  Zhenyao Mo  <zmo@google.com>
     2
     3        Reviewed by Oliver Hunt.
     4
     5        Fix a potential integer overflow in WebGL*Array::slice()
     6        https://bugs.webkit.org/show_bug.cgi?id=37466
     7
     8        * fast/canvas/webgl/array-unit-tests-expected.txt: Add tests that would cause overflow without this fix, but work fine with this fix.
     9        * fast/canvas/webgl/array-unit-tests.html: Ditto.
     10
    1112010-04-13  Darin Fisher  <darin@chromium.org>
    212

  • trunk/LayoutTests/fast/canvas/webgl/array-unit-tests-expected.txt

    r56291 r57559  
    5151PASS array.slice(4, 0x3FFFFFFF).length is (32 / typeSize) - 4
    5252PASS array.slice(4, -2147483648).length is 0
     53PASS array.length is 0
    5354Testing slicing with default inputs of WebGLFloatArray
    5455PASS array.length is 32 / typeSize
    … …  
    8081PASS array.slice(4, 0x3FFFFFFF).length is (32 / typeSize) - 4
    8182PASS array.slice(4, -2147483648).length is 0
     83PASS array.length is 0
    8284Testing slicing with default inputs of WebGLIntArray
    8385PASS array.length is 32 / typeSize
    … …  
    109111PASS array.slice(4, 0x3FFFFFFF).length is (32 / typeSize) - 4
    110112PASS array.slice(4, -2147483648).length is 0
     113PASS array.length is 0
    111114Testing slicing with default inputs of WebGLShortArray
    112115PASS array.length is 32 / typeSize
    … …  
    166169PASS array.slice(4, 0x3FFFFFFF).length is (32 / typeSize) - 4
    167170PASS array.slice(4, -2147483648).length is 0
     171PASS array.length is 0
    168172Testing slicing with default inputs of WebGLUnsignedIntArray
    169173PASS array.length is 32 / typeSize
    … …  
    195199PASS array.slice(4, 0x3FFFFFFF).length is (32 / typeSize) - 4
    196200PASS array.slice(4, -2147483648).length is 0
     201PASS array.length is 0
    197202Testing slicing with default inputs of WebGLUnsignedShortArray
    198203PASS array.length is 32 / typeSize

  • trunk/LayoutTests/fast/canvas/webgl/array-unit-tests.html

    r56291 r57559  
    429429            shouldBe("array.slice(4, 0x3FFFFFFF).length", "(32 / typeSize) - 4");
    430430            shouldBe("array.slice(4, -2147483648).length", "0");
     431            // Test slice() against overflows.
     432            array = array.slice(2);
     433            if (sz > 1) {
     434                // Full byte offset is +1 larger than the maximum unsigned long int.
     435                // Make sure slice() still handles it correctly.  Otherwise overflow would happen and
     436                // offset would be 0, and array.length array.length would incorrectly be 1.
     437                var start = 4294967296 / sz - 2;
     438                array = array.slice(start, start + 1);
     439                shouldBe("array.length", "0");
     440            }
    431441        } catch (e) {
    432442            testFailed("Slicing of " + name + " threw exception");

  • trunk/WebCore/ChangeLog

    r57558 r57559  
     12010-04-13  Zhenyao Mo  <zmo@google.com>
     2
     3        Reviewed by Oliver Hunt.
     4
     5        Fix a potential integer overflow in WebGL*Array::slice()
     6        https://bugs.webkit.org/show_bug.cgi?id=37466
     7
     8        * html/canvas/WebGLArray.h:
     9        (WebCore::WebGLArray::clampOffsetAndNumElements): Input parameter "offset"'s semantic changed from in bytes from buffer to in elements from array view; calculate offset in bytes from buffer inside the function, avoiding overflow.
     10        * html/canvas/WebGLByteArray.cpp:
     11        (WebCore::WebGLByteArray::slice): Changed according to new semantic of WebCore::WebGLArray::clampOffsetAndNumElements.
     12        * html/canvas/WebGLFloatArray.cpp:
     13        (WebCore::WebGLFloatArray::slice): Ditto.
     14        * html/canvas/WebGLIntArray.cpp:
     15        (WebCore::WebGLIntArray::slice): Ditto.
     16        * html/canvas/WebGLShortArray.cpp:
     17        (WebCore::WebGLShortArray::slice): Ditto.
     18        * html/canvas/WebGLUnsignedByteArray.cpp:
     19        (WebCore::WebGLUnsignedByteArray::slice): Ditto.
     20        * html/canvas/WebGLUnsignedIntArray.cpp:
     21        (WebCore::WebGLUnsignedIntArray::slice): Ditto.
     22        * html/canvas/WebGLUnsignedShortArray.cpp:
     23        (WebCore::WebGLUnsignedShortArray::slice): Ditto.
     24
    1252010-04-13  Darin Fisher  <darin@chromium.org>
    226

  • trunk/WebCore/html/canvas/WebGLArray.h

    r56291 r57559  
    9191    }
    9292
     93    // Input offset is in number of elements from this array's view;
     94    // output offset is in number of bytes from the underlying buffer's view.
    9395    template <typename T>
    9496    static void clampOffsetAndNumElements(PassRefPtr<WebGLArrayBuffer> buffer,
    95                                           unsigned *byteOffset,
     97                                          unsigned arrayByteOffset,
     98                                          unsigned *offset,
    9699                                          unsigned *numElements)
    97100    {
    98         *byteOffset = std::min(buffer->byteLength(), *byteOffset);
    99         unsigned remainingElements = (buffer->byteLength() - *byteOffset) / sizeof(T);
     101        unsigned maxOffset = (UINT_MAX - arrayByteOffset) / sizeof(T);
     102        if (*offset > maxOffset) {
     103            *offset = buffer->byteLength();
     104            *numElements = 0;
     105            return;
     106        }
     107        *offset = arrayByteOffset + *offset * sizeof(T);
     108        *offset = std::min(buffer->byteLength(), *offset);
     109        unsigned remainingElements = (buffer->byteLength() - *offset) / sizeof(T);
    100110        *numElements = std::min(remainingElements, *numElements);
    101111    }

  • trunk/WebCore/html/canvas/WebGLByteArray.cpp

    r56291 r57559  
    7575    unsigned offset, length;
    7676    calculateOffsetAndLength(start, end, m_size, &offset, &length);
    77     unsigned fullOffset = m_byteOffset + offset * sizeof(signed char);
    78     clampOffsetAndNumElements<signed char>(buffer().get(), &fullOffset, &length);
    79     return create(buffer(), fullOffset, length);
     77    clampOffsetAndNumElements<signed char>(buffer().get(), m_byteOffset, &offset, &length);
     78    return create(buffer(), offset, length);
    8079}
    8180

  • trunk/WebCore/html/canvas/WebGLFloatArray.cpp

    r56291 r57559  
    7474    unsigned offset, length;
    7575    calculateOffsetAndLength(start, end, m_size, &offset, &length);
    76     unsigned fullOffset = m_byteOffset + offset * sizeof(float);
    77     clampOffsetAndNumElements<float>(buffer(), &fullOffset, &length);
    78     return create(buffer(), fullOffset, length);
     76    clampOffsetAndNumElements<float>(buffer(), m_byteOffset, &offset, &length);
     77    return create(buffer(), offset, length);
    7978}
    8079

  • trunk/WebCore/html/canvas/WebGLIntArray.cpp

    r56291 r57559  
    7777    unsigned offset, length;
    7878    calculateOffsetAndLength(start, end, m_size, &offset, &length);
    79     unsigned fullOffset = m_byteOffset + offset * sizeof(int);
    80     clampOffsetAndNumElements<int>(buffer(), &fullOffset, &length);
    81     return create(buffer(), fullOffset, length);
     79    clampOffsetAndNumElements<int>(buffer(), m_byteOffset, &offset, &length);
     80    return create(buffer(), offset, length);
    8281}
    8382

  • trunk/WebCore/html/canvas/WebGLShortArray.cpp

    r56291 r57559  
    7676    unsigned offset, length;
    7777    calculateOffsetAndLength(start, end, m_size, &offset, &length);
    78     unsigned fullOffset = m_byteOffset + offset * sizeof(short);
    79     clampOffsetAndNumElements<short>(buffer(), &fullOffset, &length);
    80     return create(buffer(), fullOffset, length);
     78    clampOffsetAndNumElements<short>(buffer(), m_byteOffset, &offset, &length);
     79    return create(buffer(), offset, length);
    8180}
    8281

  • trunk/WebCore/html/canvas/WebGLUnsignedByteArray.cpp

    r56291 r57559  
    7777    unsigned offset, length;
    7878    calculateOffsetAndLength(start, end, m_size, &offset, &length);
    79     unsigned fullOffset = m_byteOffset + offset * sizeof(unsigned char);
    80     clampOffsetAndNumElements<unsigned char>(buffer(), &fullOffset, &length);
    81     return create(buffer(), fullOffset, length);
     79    clampOffsetAndNumElements<unsigned char>(buffer(), m_byteOffset, &offset, &length);
     80    return create(buffer(), offset, length);
    8281}
    8382

  • trunk/WebCore/html/canvas/WebGLUnsignedIntArray.cpp

    r56291 r57559  
    7777    unsigned offset, length;
    7878    calculateOffsetAndLength(start, end, m_size, &offset, &length);
    79     unsigned fullOffset = m_byteOffset + offset * sizeof(unsigned int);
    80     clampOffsetAndNumElements<unsigned int>(buffer(), &fullOffset, &length);
    81     return create(buffer(), fullOffset, length);
     79    clampOffsetAndNumElements<unsigned int>(buffer(), m_byteOffset, &offset, &length);
     80    return create(buffer(), offset, length);
    8281}
    8382

  • trunk/WebCore/html/canvas/WebGLUnsignedShortArray.cpp

    r56291 r57559  
    7979    unsigned offset, length;
    8080    calculateOffsetAndLength(start, end, m_size, &offset, &length);
    81     unsigned fullOffset = m_byteOffset + offset * sizeof(unsigned short);
    82     clampOffsetAndNumElements<unsigned short>(buffer(), &fullOffset, &length);
    83     return create(buffer(), fullOffset, length);
     81    clampOffsetAndNumElements<unsigned short>(buffer(), m_byteOffset, &offset, &length);
     82    return create(buffer(), offset, length);
    8483}
    8584
Note: See TracChangeset for help on using the changeset viewer.