Check offset argument to gpu::gles2::BufferManager::BufferInfo::SetRange is n...

gpu/command_buffer/service/buffer_manager.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/buffer_manager.h"
 #include "base/logging.h"
 #include "gpu/command_buffer/common/gles2_cmd_utils.h"
 #include "gpu/command_buffer/service/gles2_cmd_decoder.h"
 
 namespace gpu {
@@ skipping 61 matching lines @@
     if (shadowed_) {
       shadow_.reset(new int8[size]);
       memset(shadow_.get(), 0, size);
     }
   }
 }
 
 bool BufferManager::BufferInfo::SetRange(
     GLintptr offset, GLsizeiptr size, const GLvoid * data) {
   DCHECK(!IsDeleted());
-  if (offset + size < offset || offset + size > size_) {
+  if (offset < 0 || offset + size < offset || offset + size > size_) {
     return false;
   }
   if (shadowed_) {
     memcpy(shadow_.get() + offset, data, size);
     ClearCache();
   }
   return true;
 }
 
 const void* BufferManager::BufferInfo::GetRange(
     GLintptr offset, GLsizeiptr size) const {
-  if (!shadowed_ || (offset + size < offset || offset + size > size_)) {
+  if (!shadowed_) {
+    return NULL;
+  }
+  if (offset < 0 || offset + size < offset || offset + size > size_) {
     return NULL;
   }
   return shadow_.get() + offset;
 }
 
 void BufferManager::BufferInfo::ClearCache() {
   range_set_.clear();
 }
 
 template <typename T>
@@ skipping 96 matching lines @@
   if (info->target() == 0) {
     info->set_target(target);
   }
   return true;
 }
 
 }  // namespace gles2
 }  // namespace gpu