WebGL 2: validate read buffer attachment when reading from FBO

Source/core/html/canvas/WebGL2RenderingContextBase.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/html/canvas/WebGL2RenderingContextBase.h"
 
 #include "bindings/core/v8/WebGLAny.h"
 #include "core/html/HTMLCanvasElement.h"
 #include "core/html/HTMLImageElement.h"
@@ skipping 150 matching lines @@
         return;
 
     webContext()->invalidateSubFramebuffer(target, attachments.size(), attachments.data(), x, y, width, height);
 }
 
 void WebGL2RenderingContextBase::readBuffer(GLenum mode)
 {
     if (isContextLost())
         return;
 
+    switch (mode) {
+    case GL_BACK:
+    case GL_NONE:
+    case GL_COLOR_ATTACHMENT0:
+        break;
+    default:
+        if (attachment > GL_COLOR_ATTACHMENT0
+            && attachment < static_cast<GLenum>(GL_COLOR_ATTACHMENT0 + maxColorAttachments()))
+            break;
+        synthesizeGLError(GL_INVALID_ENUM, "readBuffer", "invalid read buffer");
+        return;
+    }
+
+    WebGLFramebuffer* readFramebufferBinding = getFramebufferBinding(GL_READ_FRAMEBUFFER);
+    if (!readFramebufferBinding) {
+        ASSERT(drawingBuffer());
+        if (mode != GL_BACK || mode != GL_NONE) {
+            synthesizeGLError(GL_INVALID_OPERATION, "readBuffer", "invalid read buffer");
+            return;
+        }
+    } else {
+        if (mode == GL_BACK) {
+            synthesizeGLError(GL_INVALID_OPERATION, "readBuffer", "invalid read buffer");
+            return;
+        }
+        m_readbufferOfFBO = mode;
+    }
     webContext()->readBuffer(mode);
 }
 
 void WebGL2RenderingContextBase::renderbufferStorageImpl(
     GLenum target, GLsizei samples, GLenum internalformat, GLsizei width, GLsizei height,
     const char* functionName)
 {
     switch (internalformat) {
     case GL_R8UI:
     case GL_R8I:
@@ skipping 1904 matching lines @@
         m_boundPixelUnpackBuffer = nullptr;
     if (m_boundTransformFeedbackBuffer == buffer)
         m_boundTransformFeedbackBuffer = nullptr;
     if (m_boundUniformBuffer == buffer)
         m_boundUniformBuffer = nullptr;
 
     WebGLRenderingContextBase::removeBoundBuffer(buffer);
 }
 
 } // namespace blink