commit 4d632d8e79efb6f2a2d95da7659e674026f3aef0
author Jamie Madill <jmadill@chromium.org> Mon Jun 16 13:20:17 2014 -0400
committer Jamie Madill <jmadill@chromium.org> Mon Jun 16 18:50:04 2014 +0000
tree 86493e23a604e43bb782a99ac77dd735f875b30f
parent f26ecc81cf58b831042db6701a1ed3448caf83cd

Fix buffer overflow error on buffer resize.

We were using the new, larger size for our buffer data copy step,
instead of the old, smaller size. This bug was causing a crash on
older nVidia drivers during normal browser usage.

Reproducible with the index-validation-large-buffer WebGL test.

BUG=angle:667
BUG=384420

Change-Id: I98ee893e0d8ba0bfc9adfe5a338da9b940248879
Reviewed-on: https://chromium-review.googlesource.com/203776
Tested-by: Jamie Madill <jmadill@chromium.org>
Reviewed-by: Shannon Woods <shannonwoods@chromium.org>
Reviewed-by: Geoff Lang <geofflang@chromium.org>

src/libGLESv2/renderer/d3d11/BufferStorage11.cpp

diff --git a/src/libGLESv2/renderer/d3d11/BufferStorage11.cpp b/src/libGLESv2/renderer/d3d11/BufferStorage11.cpp
index fc8140a..eb82aac 100644
--- a/src/libGLESv2/renderer/d3d11/BufferStorage11.cpp
+++ b/src/libGLESv2/renderer/d3d11/BufferStorage11.cpp
@@ -646,9 +646,12 @@
 
     if (mNativeBuffer && preserveData)
     {
+        // We don't call resize if the buffer is big enough already.
+        ASSERT(mBufferSize <= size);
+
         D3D11_BOX srcBox;
         srcBox.left = 0;
-        srcBox.right = size;
+        srcBox.right = mBufferSize;
         srcBox.top = 0;
         srcBox.bottom = 1;
         srcBox.front = 0;