WebGL: validations and fixes to avoid buffer/texture overflow

Source/modules/webgl/WebGL2RenderingContextBase.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "modules/webgl/WebGL2RenderingContextBase.h"
 
 #include "bindings/modules/v8/WebGLAny.h"
 #include "core/html/HTMLCanvasElement.h"
 #include "core/html/HTMLImageElement.h"
@@ skipping 88 matching lines @@
     }
 
     WebGLBuffer* readBuffer = validateBufferDataTarget("copyBufferSubData", readTarget);
     if (!readBuffer)
         return;
 
     WebGLBuffer* writeBuffer = validateBufferDataTarget("copyBufferSubData", writeTarget);
     if (!writeBuffer)
         return;
 
+    if (readOffset + size > readBuffer->getSize() || writeOffset + size > writeBuffer->getSize()) {

[Zhenyao Mo, 2015/09/02 17:59:03]

Overflow detection. We made sure the offset/size fits uint32, so two plus
together could overflow int64.

[yunchao, 2015/09/04 08:22:07]

the function validateValueFitNonNegInt32 makes sure that offset/size are less
than 2 ^ 31 -1, although offset/size are both int64(long long). So offset plus
size will not overflow int64, right? 

[Zhenyao Mo, 2015/09/04 18:36:28]

Not really.  Two uint32 adding won't overflow uint64, but it still can overflow
int64.  Here and below.

+        synthesizeGLError(GL_INVALID_VALUE, "copyBufferSubData", "buffer overflow");
+        return;
+    }
+
     if ((writeBuffer->getInitialTarget() == GL_ELEMENT_ARRAY_BUFFER && readBuffer->getInitialTarget() != GL_ELEMENT_ARRAY_BUFFER)
         || (writeBuffer->getInitialTarget() != GL_ELEMENT_ARRAY_BUFFER && readBuffer->getInitialTarget() == GL_ELEMENT_ARRAY_BUFFER)) {
         synthesizeGLError(GL_INVALID_OPERATION, "copyBufferSubData", "Cannot copy into an element buffer destination from a non-element buffer source");
         return;
     }
 
     if (writeBuffer->getInitialTarget() == 0)
         writeBuffer->setInitialTarget(readBuffer->getInitialTarget());
 
     webContext()->copyBufferSubData(readTarget, writeTarget, static_cast<GLintptr>(readOffset), static_cast<GLintptr>(writeOffset), static_cast<GLsizeiptr>(size));
 }
 
 void WebGL2RenderingContextBase::getBufferSubData(GLenum target, long long offset, DOMArrayBuffer* returnedData)
 {
     if (isContextLost())
         return;
 
     if (!returnedData) {
         synthesizeGLError(GL_INVALID_VALUE, "getBufferSubData", "ArrayBuffer cannot be null");
         return;
     }
 
     if (!validateValueFitNonNegInt32("getBufferSubData", "offset", offset)) {
         return;
     }
 
+    WebGLBuffer* buffer = validateBufferDataTarget("getBufferSubData", target);
+    if (!buffer)
+        return;
+    if (offset + returnedData->byteLength() > buffer->getSize()) {

[Zhenyao Mo, 2015/09/02 17:59:03]

Same here. overflow detection.

[yunchao, 2015/09/04 08:22:07]

same here.

+        synthesizeGLError(GL_INVALID_VALUE, "getBufferSubData", "buffer overflow");
+        return;
+    }
+
     void* mappedData = webContext()->mapBufferRange(target, static_cast<GLintptr>(offset), returnedData->byteLength(), GL_MAP_READ_BIT);
 
     if (!mappedData)
         return;
 
     memcpy(returnedData->data(), mappedData, returnedData->byteLength());
 
     webContext()->unmapBuffer(target);
 }
 
@@ skipping 345 matching lines @@
         return false;
     }
 
     WebGLTexture* tex = validateTextureBinding(functionName, target, false);
     if (!tex)
         return false;
 
     if (!validateTexFuncLevel(functionName, target, level))
         return false;
 
-    if (width - xoffset > tex->getWidth(target, level)
-        || height - yoffset > tex->getHeight(target, level)
-        || depth - zoffset > tex->getDepth(target, level)) {
-        synthesizeGLError(GL_INVALID_OPERATION, functionName, "dimensions out of range");
+    if (width + xoffset > tex->getWidth(target, level)

[Zhenyao Mo, 2015/09/02 17:59:03]

Same here, overflow detection.

[yunchao, 2015/09/04 08:22:07]

Done.

+        || height + yoffset > tex->getHeight(target, level)
+        || depth + zoffset > tex->getDepth(target, level)) {
+        synthesizeGLError(GL_INVALID_VALUE, functionName, "dimensions out of range");
         return false;
     }
 
     GLenum internalformat = tex->getInternalFormat(target, level);
     if (!validateTexFuncFormatAndType(functionName, internalformat, format, type, level))
         return false;
 
     return true;
 }
 
@@ skipping 76 matching lines @@
     }
     if (m_unpackAlignment != 1)
         webContext()->pixelStorei(GL_UNPACK_ALIGNMENT, 1);
     webContext()->texSubImage3D(target, level, xoffset, yoffset, zoffset, pixels->width(), pixels->height(), 1, format, type, needConversion ? data.data() : pixels->data()->data());
     if (m_unpackAlignment != 1)
         webContext()->pixelStorei(GL_UNPACK_ALIGNMENT, m_unpackAlignment);
 }
 
 void WebGL2RenderingContextBase::texSubImage3D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLenum format, GLenum type, HTMLImageElement* image, ExceptionState& exceptionState)
 {
-    if (isContextLost() || !image || !validateTexSubImage3D("texSubImage3D", target, level, xoffset, yoffset, zoffset, format, type, image->width(), image->height(), 1))
-        return;
-
-    if (isContextLost() || !validateHTMLImageElement("texSubImage3D", image, exceptionState))
+    if (isContextLost() || !image || !validateHTMLImageElement("texSubImage3D", image, exceptionState))
         return;
 
     RefPtr<Image> imageForRender = image->cachedImage()->imageForLayoutObject(image->layoutObject());
     if (imageForRender->isSVGImage())
         imageForRender = drawImageIntoBuffer(imageForRender.get(), image->width(), image->height(), "texSubImage3D");
 
     texSubImage3DImpl(target, level, xoffset, yoffset, zoffset, format, type, imageForRender.get(), WebGLImageConversion::HtmlDomImage, m_unpackFlipY, m_unpackPremultiplyAlpha);
 }
 
 void WebGL2RenderingContextBase::texSubImage3D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLenum format, GLenum type, HTMLCanvasElement* canvas, ExceptionState& exceptionState)
@@ skipping 1042 matching lines @@
 void WebGL2RenderingContextBase::bindBufferRange(GLenum target, GLuint index, WebGLBuffer* buffer, long long offset, long long size)
 {
     if (isContextLost() || !validateWebGLObject("bindBufferRange", buffer))
         return;
 
     if (!validateValueFitNonNegInt32("bindBufferRange", "offset", offset)
         || !validateValueFitNonNegInt32("bindBufferRange", "size", size)) {
         return;
     }
 
+    if (buffer && (offset + size > buffer->getSize())) {

[Zhenyao Mo, 2015/09/02 17:59:03]

Same here, overflow detection.

[yunchao, 2015/09/04 08:22:07]

same here

+        synthesizeGLError(GL_INVALID_VALUE, "bindBufferRange", "buffer overflow");
+        return;
+    }
+
     webContext()->bindBufferRange(target, index, objectOrZero(buffer), static_cast<GLintptr>(offset), static_cast<GLsizeiptr>(size));
 }
 
 ScriptValue WebGL2RenderingContextBase::getIndexedParameter(ScriptState* scriptState, GLenum target, GLuint index)
 {
     if (isContextLost())
         return ScriptValue::createNull(scriptState);
 
     switch (target) {
     case GL_TRANSFORM_FEEDBACK_BUFFER_BINDING:
@@ skipping 869 matching lines @@
 GLenum WebGL2RenderingContextBase::boundFramebufferColorFormat()
 {
     if (m_readFramebufferBinding && m_readFramebufferBinding->object())
         return m_readFramebufferBinding->colorBufferFormat();
     if (m_requestedAttributes.alpha())
         return GL_RGBA;
     return GL_RGB;
 }
 
 } // namespace blink