commit 0c8b4e563e2926f37b5b357c1fafb7115d272e03
author Geoff Lang <geofflang@google.com> Tue Jul 09 15:58:36 2013 -0400
committer Shannon Woods <shannonwoods@chromium.org> Thu Jul 11 13:09:53 2013 -0400
tree 9e88b4f4650da1a357016c8b0a8821f0295d5917
parent 479132914528d9eba880f177651729cc4379919f

Protect against integer overflows in the VertexBuffer class by validating the reserved space.

Issue 444

Signed-off-by: Jamie Madil
Signed-off-by: Shannon Woods
Author: Geoff Lang

src/libGLESv2/renderer/VertexBuffer.cpp

diff --git a/src/libGLESv2/renderer/VertexBuffer.cpp b/src/libGLESv2/renderer/VertexBuffer.cpp
index 16e1486..a858946 100644
--- a/src/libGLESv2/renderer/VertexBuffer.cpp
+++ b/src/libGLESv2/renderer/VertexBuffer.cpp
@@ -125,14 +125,30 @@
     return oldWritePos;
 }
 
-void VertexBufferInterface::reserveVertexSpace(const gl::VertexAttribute &attribute, GLsizei count, GLsizei instances)
+bool VertexBufferInterface::reserveVertexSpace(const gl::VertexAttribute &attribute, GLsizei count, GLsizei instances)
 {
-    mReservedSpace += mVertexBuffer->getSpaceRequired(attribute, count, instances);
+    unsigned int requiredSpace = mVertexBuffer->getSpaceRequired(attribute, count, instances);
+
+    // Protect against integer overflow
+    if (mReservedSpace + requiredSpace < mReservedSpace)
+    {
+         return false;
+    }
+
+    mReservedSpace += requiredSpace;
+    return true;
 }
 
-void VertexBufferInterface::reserveRawDataSpace(unsigned int size)
+bool VertexBufferInterface::reserveRawDataSpace(unsigned int size)
 {
+    // Protect against integer overflow
+    if (mReservedSpace + size < mReservedSpace)
+    {
+         return false;
+    }
+
     mReservedSpace += size;
+    return true;
 }
 
 VertexBuffer* VertexBufferInterface::getVertexBuffer() const

src/libGLESv2/renderer/VertexBuffer.h

diff --git a/src/libGLESv2/renderer/VertexBuffer.h b/src/libGLESv2/renderer/VertexBuffer.h
index 6ecffd0..c474b05 100644
--- a/src/libGLESv2/renderer/VertexBuffer.h
+++ b/src/libGLESv2/renderer/VertexBuffer.h
@@ -60,8 +60,8 @@
     VertexBufferInterface(rx::Renderer *renderer, bool dynamic);
     virtual ~VertexBufferInterface();
 
-    void reserveVertexSpace(const gl::VertexAttribute &attribute, GLsizei count, GLsizei instances);
-    void reserveRawDataSpace(unsigned int size);
+    bool reserveVertexSpace(const gl::VertexAttribute &attribute, GLsizei count, GLsizei instances);
+    bool reserveRawDataSpace(unsigned int size);
 
     unsigned int getBufferSize() const;
 

src/libGLESv2/renderer/VertexDataManager.cpp

diff --git a/src/libGLESv2/renderer/VertexDataManager.cpp b/src/libGLESv2/renderer/VertexDataManager.cpp
index ec85857..fd869b1 100644
--- a/src/libGLESv2/renderer/VertexDataManager.cpp
+++ b/src/libGLESv2/renderer/VertexDataManager.cpp
@@ -116,12 +116,18 @@
                     if (staticBuffer->getBufferSize() == 0)
                     {
                         int totalCount = elementsInBuffer(attribs[i], buffer->size());
-                        staticBuffer->reserveVertexSpace(attribs[i], totalCount, 0);
+                        if (!staticBuffer->reserveVertexSpace(attribs[i], totalCount, 0))
+                        {
+                            return GL_OUT_OF_MEMORY;
+                        }
                     }
                 }
                 else
                 {
-                    mStreamingBuffer->reserveVertexSpace(attribs[i], count, instances);
+                    if (!mStreamingBuffer->reserveVertexSpace(attribs[i], count, instances))
+                    {
+                        return GL_OUT_OF_MEMORY;
+                    }
                 }
             }
         }
@@ -217,7 +223,10 @@
                     mCurrentValue[i][3] != attribs[i].mCurrentValue[3])
                 {
                     unsigned int requiredSpace = sizeof(float) * 4;
-                    buffer->reserveRawDataSpace(requiredSpace);
+                    if (!buffer->reserveRawDataSpace(requiredSpace))
+                    {
+                        return GL_OUT_OF_MEMORY;
+                    }
                     int streamOffset = buffer->storeRawData(attribs[i].mCurrentValue, requiredSpace);
                     if (streamOffset == -1)
                     {