Skip to content

Commit

Permalink
[webgl] Move size check of texImage* out of bindings code
Browse files Browse the repository at this point in the history 
This is a follow-up CL to
https://chromium-review.googlesource.com/c/chromium/src/+/3825862 to
change the size checks for the remaining webgl2 operations.

R=kbr@chromium.org

Bug: chromium:1344047
Change-Id: I06ca5cea351a0abd041c8817b4e0ee9c00004961
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3834791
Reviewed-by: Kenneth Russell <kbr@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1069040}
  • Loading branch information
@gahaas
gahaas authored and Chromium LUCI CQ committed Nov 9, 2022
1 parent abb3e42 commit 1438bc4
Show file tree
Hide file tree
Showing 5 changed files with 203 additions and 22 deletions.
24 changes: 24 additions & 0 deletions third_party/blink/renderer/modules/webgl/webgl2_rendering_context_base.cc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2419,6 +2419,12 @@ void WebGL2RenderingContextBase::compressedTexImage2D(
"srcLengthOverride is out of range");
return;
}
if (static_cast<size_t>(src_length_override) >
kMaximumSupportedArrayBufferSize) {
SynthesizeGLError(GL_INVALID_VALUE, "compressedTexImage2D",
"src_length_override exceeds the supported range");
return;
}
ContextGL()->CompressedTexImage2D(
target, level, internalformat, width, height, border, src_length_override,
static_cast<uint8_t*>(data->BaseAddressMaybeShared()) + src_offset);
Expand Down Expand Up @@ -2501,6 +2507,12 @@ void WebGL2RenderingContextBase::compressedTexSubImage2D(
"srcLengthOverride is out of range");
return;
}
if (static_cast<size_t>(src_length_override) >
kMaximumSupportedArrayBufferSize) {
SynthesizeGLError(GL_INVALID_VALUE, "compressedTexSubImage2D",
"src_length_override exceeds the supported range");
return;
}
ContextGL()->CompressedTexSubImage2D(
target, level, xoffset, yoffset, width, height, format,
src_length_override,
Expand Down Expand Up @@ -2565,6 +2577,12 @@ void WebGL2RenderingContextBase::compressedTexImage3D(
"srcLengthOverride is out of range");
return;
}
if (static_cast<size_t>(src_length_override) >
kMaximumSupportedArrayBufferSize) {
SynthesizeGLError(GL_INVALID_VALUE, "compressedTexImage3D",
"src_length_override exceeds the supported range");
return;
}
ContextGL()->CompressedTexImage3D(
target, level, internalformat, width, height, depth, border,
src_length_override,
Expand Down Expand Up @@ -2633,6 +2651,12 @@ void WebGL2RenderingContextBase::compressedTexSubImage3D(
"srcLengthOverride is out of range");
return;
}
if (static_cast<size_t>(src_length_override) >
kMaximumSupportedArrayBufferSize) {
SynthesizeGLError(GL_INVALID_VALUE, "compressedTexSubImage3D",
"src_length_override exceeds the supported range");
return;
}
ContextGL()->CompressedTexSubImage3D(
target, level, xoffset, yoffset, zoffset, width, height, depth, format,
src_length_override,
Expand Down
41 changes: 30 additions & 11 deletions third_party/blink/renderer/modules/webgl/webgl2_rendering_context_base.idl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -303,7 +303,9 @@ interface mixin WebGL2RenderingContextBase {
[CallWith=ExecutionContext, RaisesException] void texImage2D(GLenum target, GLint level, GLint internalformat, GLsizei width, GLsizei height, GLint border, GLenum format, GLenum type, HTMLVideoElement video);
[CallWith=ExecutionContext, RaisesException, RuntimeEnabled=WebCodecs] void texImage2D(GLenum target, GLint level, GLint internalformat, GLsizei width, GLsizei height, GLint border, GLenum format, GLenum type, VideoFrame frame);
[RaisesException] void texImage2D(GLenum target, GLint level, GLint internalformat, GLsizei width, GLsizei height, GLint border, GLenum format, GLenum type, ImageBitmap bitmap);
void texImage2D(GLenum target, GLint level, GLint internalformat, GLsizei width, GLsizei height, GLint border, GLenum format, GLenum type, [AllowShared] ArrayBufferView srcData, GLuint srcOffset);
void texImage2D(GLenum target, GLint level, GLint internalformat, GLsizei width,
GLsizei height, GLint border, GLenum format, GLenum type,
[AllowShared, BufferSourceTypeNoSizeLimit] ArrayBufferView srcData, GLuint srcOffset);
void texSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLsizei width, GLsizei height, GLenum format, GLenum type, GLintptr offset);
void texSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLsizei width, GLsizei height, GLenum format, GLenum type, ImageData data);
[CallWith=ExecutionContext, RaisesException] void texSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLsizei width, GLsizei height, GLenum format, GLenum type, HTMLImageElement image);
Expand All @@ -312,7 +314,9 @@ interface mixin WebGL2RenderingContextBase {
[CallWith=ExecutionContext, RaisesException] void texSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLsizei width, GLsizei height, GLenum format, GLenum type, HTMLVideoElement video);
[CallWith=ExecutionContext, RaisesException, RuntimeEnabled=WebCodecs] void texSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLsizei width, GLsizei height, GLenum format, GLenum type, VideoFrame frame);
[RaisesException] void texSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLsizei width, GLsizei height, GLenum format, GLenum type, ImageBitmap bitmap);
void texSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLsizei width, GLsizei height, GLenum format, GLenum type, [AllowShared] ArrayBufferView srcData, GLuint srcOffset);
void texSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset,
GLsizei width, GLsizei height, GLenum format, GLenum type,
[AllowShared, BufferSourceTypeNoSizeLimit] ArrayBufferView srcData, GLuint srcOffset);
void texStorage2D(GLenum target, GLsizei levels, GLenum internalformat, GLsizei width, GLsizei height);
void texStorage3D(GLenum target, GLsizei levels, GLenum internalformat, GLsizei width, GLsizei height, GLsizei depth);
void texImage3D(GLenum target, GLint level, GLint internalformat, GLsizei width, GLsizei height, GLsizei depth, GLint border, GLenum format, GLenum type, GLintptr offset);
Expand All @@ -323,8 +327,14 @@ interface mixin WebGL2RenderingContextBase {
[CallWith=ExecutionContext, RaisesException] void texImage3D(GLenum target, GLint level, GLint internalformat, GLsizei width, GLsizei height, GLsizei depth, GLint border, GLenum format, GLenum type, HTMLVideoElement video);
[CallWith=ExecutionContext, RaisesException, RuntimeEnabled=WebCodecs] void texImage3D(GLenum target, GLint level, GLint internalformat, GLsizei width, GLsizei height, GLsizei depth, GLint border, GLenum format, GLenum type, VideoFrame frame);
[RaisesException] void texImage3D(GLenum target, GLint level, GLint internalformat, GLsizei width, GLsizei height, GLsizei depth, GLint border, GLenum format, GLenum type, ImageBitmap bitmap);
void texImage3D(GLenum target, GLint level, GLint internalformat, GLsizei width, GLsizei height, GLsizei depth, GLint border, GLenum format, GLenum type, [AllowShared] ArrayBufferView? pixels);
void texImage3D(GLenum target, GLint level, GLint internalformat, GLsizei width, GLsizei height, GLsizei depth, GLint border, GLenum format, GLenum type, [AllowShared] ArrayBufferView pixels, GLuint srcOffset);
void texImage3D(GLenum target, GLint level, GLint internalformat,
GLsizei width, GLsizei height, GLsizei depth, GLint border,
GLenum format, GLenum type,
[AllowShared, BufferSourceTypeNoSizeLimit] ArrayBufferView? pixels);
void texImage3D(GLenum target, GLint level, GLint internalformat,
GLsizei width, GLsizei height, GLsizei depth, GLint border,
GLenum format, GLenum type,
[AllowShared, BufferSourceTypeNoSizeLimit] ArrayBufferView pixels, GLuint srcOffset);
void texSubImage3D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width, GLsizei height, GLsizei depth, GLenum format, GLenum type, GLintptr offset);
void texSubImage3D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width, GLsizei height, GLsizei depth, GLenum format, GLenum type, ImageData data);
[CallWith=ExecutionContext, RaisesException] void texSubImage3D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width, GLsizei height, GLsizei depth, GLenum format, GLenum type, HTMLImageElement image);
Expand All @@ -333,20 +343,29 @@ interface mixin WebGL2RenderingContextBase {
[CallWith=ExecutionContext, RaisesException] void texSubImage3D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width, GLsizei height, GLsizei depth, GLenum format, GLenum type, HTMLVideoElement video);
[CallWith=ExecutionContext, RaisesException, RuntimeEnabled=WebCodecs] void texSubImage3D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width, GLsizei height, GLsizei depth, GLenum format, GLenum type, VideoFrame frame);
[RaisesException] void texSubImage3D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width, GLsizei height, GLsizei depth, GLenum format, GLenum type, ImageBitmap bitmap);
void texSubImage3D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width, GLsizei height, GLsizei depth, GLenum format, GLenum type, [AllowShared] ArrayBufferView pixels, optional GLuint srcOffset = 0);
void texSubImage3D(GLenum target, GLint level, GLint xoffset,
GLint yoffset, GLint zoffset, GLsizei width, GLsizei height,
GLsizei depth, GLenum format, GLenum type,
[AllowShared, BufferSourceTypeNoSizeLimit] ArrayBufferView pixels, optional GLuint srcOffset = 0);

void copyTexSubImage3D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLint x, GLint y, GLsizei width, GLsizei height);

void compressedTexImage2D(GLenum target, GLint level, GLenum internalformat,
GLsizei width, GLsizei height, GLint border,
[AllowShared] ArrayBufferView data, GLuint srcOffset,
optional GLuint srcLengthOverride = 0);
[AllowShared, BufferSourceTypeNoSizeLimit] ArrayBufferView data,
GLuint srcOffset, optional GLuint srcLengthOverride = 0);
void compressedTexSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset,
GLsizei width, GLsizei height, GLenum format,
[AllowShared] ArrayBufferView data, GLuint srcOffset,
optional GLuint srcLengthOverride = 0);
void compressedTexImage3D(GLenum target, GLint level, GLenum internalformat, GLsizei width, GLsizei height, GLsizei depth, GLint border, [AllowShared] ArrayBufferView data, optional GLuint srcOffset = 0, optional GLuint srcLengthOverride = 0);
void compressedTexSubImage3D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width, GLsizei height, GLsizei depth, GLenum format, [AllowShared] ArrayBufferView data, optional GLuint srcOffset = 0, optional GLuint srcLengthOverride = 0);
[AllowShared, BufferSourceTypeNoSizeLimit] ArrayBufferView data,
GLuint srcOffset, optional GLuint srcLengthOverride = 0);
void compressedTexImage3D(GLenum target, GLint level, GLenum internalformat,
GLsizei width, GLsizei height, GLsizei depth, GLint border,
[AllowShared, BufferSourceTypeNoSizeLimit] ArrayBufferView data,
optional GLuint srcOffset = 0, optional GLuint srcLengthOverride = 0);
void compressedTexSubImage3D(GLenum target, GLint level, GLint xoffset,
GLint yoffset, GLint zoffset, GLsizei width, GLsizei height,
GLsizei depth, GLenum format, [AllowShared, BufferSourceTypeNoSizeLimit] ArrayBufferView data,
optional GLuint srcOffset = 0, optional GLuint srcLengthOverride = 0);

void compressedTexImage2D(GLenum target, GLint level, GLenum internalformat,
GLsizei width, GLsizei height, GLint border,
Expand Down
20 changes: 18 additions & 2 deletions third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2425,6 +2425,11 @@ void WebGLRenderingContextBase::compressedTexImage2D(
GLsizei data_length;
if (!ExtractDataLengthIfValid("compressedTexImage2D", data, &data_length))
return;
if (static_cast<size_t>(data_length) > kMaximumSupportedArrayBufferSize) {
SynthesizeGLError(GL_INVALID_VALUE, "compressedTexImage2D",
"ArrayBufferView size exceeds the supported range");
return;
}
ContextGL()->CompressedTexImage2D(target, level, internalformat, width,
height, border, data_length,
data->BaseAddressMaybeShared());
Expand All @@ -2448,6 +2453,11 @@ void WebGLRenderingContextBase::compressedTexSubImage2D(
GLsizei data_length;
if (!ExtractDataLengthIfValid("compressedTexSubImage2D", data, &data_length))
return;
if (static_cast<size_t>(data_length) > kMaximumSupportedArrayBufferSize) {
SynthesizeGLError(GL_INVALID_VALUE, "compressedTexImage2D",
"ArrayBufferView size exceeds the supported range");
return;
}
ContextGL()->CompressedTexSubImage2D(target, level, xoffset, yoffset, width,
height, format, data_length,
data->BaseAddressMaybeShared());
Expand Down Expand Up @@ -8094,12 +8104,18 @@ bool WebGLRenderingContextBase::ValidateTexFuncData(
total *= pixels->TypeSize();
total += total_bytes_required;
total += skip_bytes;
if (!total.IsValid() ||
pixels->byteLength() < static_cast<size_t>(total.ValueOrDie())) {
uint32_t total_val;
if (!total.AssignIfValid(&total_val) ||
pixels->byteLength() < static_cast<size_t>(total_val)) {
SynthesizeGLError(GL_INVALID_OPERATION, function_name,
"ArrayBufferView not big enough for request");
return false;
}
if (static_cast<size_t>(total_val) > kMaximumSupportedArrayBufferSize) {
SynthesizeGLError(GL_INVALID_VALUE, function_name,
"ArrayBufferView size exceeds the supported range");
return false;
}
return true;
}

Expand Down
13 changes: 8 additions & 5 deletions third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.idl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -498,9 +498,11 @@ interface mixin WebGLRenderingContextBase {
void compileShader(WebGLShader shader);

void compressedTexImage2D(GLenum target, GLint level, GLenum internalformat,
GLsizei width, GLsizei height, GLint border, [AllowShared] ArrayBufferView data);
GLsizei width, GLsizei height, GLint border,
[AllowShared, BufferSourceTypeNoSizeLimit] ArrayBufferView data);
void compressedTexSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset,
GLsizei width, GLsizei height, GLenum format, [AllowShared] ArrayBufferView data);
GLsizei width, GLsizei height, GLenum format,
[AllowShared, BufferSourceTypeNoSizeLimit] ArrayBufferView data);

void copyTexImage2D(GLenum target, GLint level, GLenum internalformat, GLint x, GLint y, GLsizei width, GLsizei height, GLint border);
void copyTexSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint x, GLint y, GLsizei width, GLsizei height);
Expand Down Expand Up @@ -616,7 +618,8 @@ interface mixin WebGLRenderingContextBase {
void texImage2D(
GLenum target, GLint level, GLint internalformat,
GLsizei width, GLsizei height, GLint border,
GLenum format, GLenum type, [AllowShared] ArrayBufferView? pixels);
GLenum format, GLenum type,
[AllowShared, BufferSourceTypeNoSizeLimit] ArrayBufferView? pixels);
void texImage2D(
GLenum target, GLint level, GLint internalformat,
GLenum format, GLenum type, ImageData pixels);
Expand All @@ -641,8 +644,8 @@ interface mixin WebGLRenderingContextBase {

void texSubImage2D(
GLenum target, GLint level, GLint xoffset, GLint yoffset,
GLsizei width, GLsizei height,
GLenum format, GLenum type, [AllowShared] ArrayBufferView? pixels);
GLsizei width, GLsizei height, GLenum format, GLenum type,
[AllowShared, BufferSourceTypeNoSizeLimit] ArrayBufferView? pixels);
void texSubImage2D(
GLenum target, GLint level, GLint xoffset, GLint yoffset,
GLenum format, GLenum type, ImageData pixels);
Expand Down

0 comments on commit 1438bc4

Please sign in to comment.