Skip to content

Commit

Permalink
8289697: buffer overflow in MTLVertexCache.m: MTLVertexCache_AddGlyph…
Browse files Browse the repository at this point in the history
…Quad

Reviewed-by: prr
  • Loading branch information
Vladimir Kempik committed Jul 8, 2022
1 parent a13af65 commit d852e99
Showing 1 changed file with 12 additions and 2 deletions.
Expand Up @@ -65,6 +65,10 @@
MTLVC_ADD_VERTEX(TX1, TY1, DX1, DY1, 0); \
} while (0)

// Next define should exactly match to the amount
// of MTLVC_ADD_VERTEX in MTLVC_ADD_TRIANGLES
#define VERTS_FOR_A_QUAD 6

jboolean
MTLVertexCache_InitVertexCache()
{
Expand Down Expand Up @@ -219,7 +223,11 @@ void MTLVertexCache_FreeVertexCache()
J2dTraceLn1(J2D_TRACE_INFO, "MTLVertexCache_AddMaskQuad: %d",
maskCacheIndex);

if (maskCacheIndex >= MTLVC_MASK_CACHE_MAX_INDEX)
// MTLVC_ADD_TRIANGLES at the end of this function
// will place VERTS_FOR_A_QUAD vertexes to the vertex cache
// check free space and flush if needed.
if ((maskCacheIndex >= MTLVC_MASK_CACHE_MAX_INDEX) ||
((vertexCacheIndex + VERTS_FOR_A_QUAD) >= MTLVC_MAX_INDEX))
{
J2dTraceLn2(J2D_TRACE_INFO, "maskCacheIndex = %d, vertexCacheIndex = %d", maskCacheIndex, vertexCacheIndex);
MTLVertexCache_FlushVertexCache(mtlc);
Expand Down Expand Up @@ -305,7 +313,9 @@ void MTLVertexCache_FreeVertexCache()
{
J2dTraceLn(J2D_TRACE_INFO, "MTLVertexCache_AddGlyphQuad");

if (vertexCacheIndex >= MTLVC_MAX_INDEX)
// MTLVC_ADD_TRIANGLES adds VERTS_FOR_A_QUAD vertexes into Cache
// so need to check space for VERTS_FOR_A_QUAD elements
if ((vertexCacheIndex + VERTS_FOR_A_QUAD) >= MTLVC_MAX_INDEX)
{
J2dTraceLn2(J2D_TRACE_INFO, "maskCacheIndex = %d, vertexCacheIndex = %d", maskCacheIndex, vertexCacheIndex);
MTLVertexCache_FlushGlyphVertexCache();
Expand Down

5 comments on commit d852e99

@openjdk-notifier
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@VladimirKempik
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/backport jdk19

@VladimirKempik
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/backport jdk17u-dev

@openjdk
Copy link

@openjdk openjdk bot commented on d852e99 Jul 8, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@VladimirKempik the backport was successfully created on the branch VladimirKempik-backport-d852e99a in my personal fork of openjdk/jdk19. To create a pull request with this backport targeting openjdk/jdk19:master, just click the following link:

➡️ Create pull request

The title of the pull request is automatically filled in correctly and below you find a suggestion for the pull request body:

Hi all,

This pull request contains a backport of commit d852e99a from the openjdk/jdk repository.

The commit being backported was authored by Vladimir Kempik on 8 Jul 2022 and was reviewed by Phil Race.

Thanks!

If you need to update the source branch of the pull then run the following commands in a local clone of your personal fork of openjdk/jdk19:

$ git fetch https://github.com/openjdk-bots/jdk19 VladimirKempik-backport-d852e99a:VladimirKempik-backport-d852e99a
$ git checkout VladimirKempik-backport-d852e99a
# make changes
$ git add paths/to/changed/files
$ git commit --message 'Describe additional changes made'
$ git push https://github.com/openjdk-bots/jdk19 VladimirKempik-backport-d852e99a

@openjdk
Copy link

@openjdk openjdk bot commented on d852e99 Jul 8, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@VladimirKempik the backport was successfully created on the branch VladimirKempik-backport-d852e99a in my personal fork of openjdk/jdk17u-dev. To create a pull request with this backport targeting openjdk/jdk17u-dev:master, just click the following link:

➡️ Create pull request

The title of the pull request is automatically filled in correctly and below you find a suggestion for the pull request body:

Hi all,

This pull request contains a backport of commit d852e99a from the openjdk/jdk repository.

The commit being backported was authored by Vladimir Kempik on 8 Jul 2022 and was reviewed by Phil Race.

Thanks!

If you need to update the source branch of the pull then run the following commands in a local clone of your personal fork of openjdk/jdk17u-dev:

$ git fetch https://github.com/openjdk-bots/jdk17u-dev VladimirKempik-backport-d852e99a:VladimirKempik-backport-d852e99a
$ git checkout VladimirKempik-backport-d852e99a
# make changes
$ git add paths/to/changed/files
$ git commit --message 'Describe additional changes made'
$ git push https://github.com/openjdk-bots/jdk17u-dev VladimirKempik-backport-d852e99a

Please sign in to comment.