WebGL: validations and fixes to avoid buffer/texture overflow

Source/modules/webgl/WebGLRenderingContextBase.cpp

Index: Source/modules/webgl/WebGLRenderingContextBase.cpp
diff --git a/Source/modules/webgl/WebGLRenderingContextBase.cpp b/Source/modules/webgl/WebGLRenderingContextBase.cpp
index a9ede5ea3e1fad3f3e31f6e32248d76f964687f0..5fef8311ac10d23c109f15ef706368a4a8ed5a1e 100644
--- a/Source/modules/webgl/WebGLRenderingContextBase.cpp
+++ b/Source/modules/webgl/WebGLRenderingContextBase.cpp
@@ -1625,6 +1625,10 @@ void WebGLRenderingContextBase::bufferSubDataImpl(GLenum target, long long offse
         return;
     if (!data)
         return;
+    if (offset + static_cast<long long>(size) > buffer->getSize()) {
+        synthesizeGLError(GL_INVALID_VALUE, "bufferSubData", "buffer overflow");
+        return;
+    }
 
     webContext()->bufferSubData(target, static_cast<GLintptr>(offset), size, data);
 }
@@ -5878,9 +5882,9 @@ bool WebGLRenderingContextBase::validateCompressedTexSubDimensions(const char* f
             synthesizeGLError(GL_INVALID_OPERATION, functionName, "xoffset or yoffset not multiple of 4");
             return false;
         }
-        if (width - xoffset > tex->getWidth(target, level)
-            || height - yoffset > tex->getHeight(target, level)) {
-            synthesizeGLError(GL_INVALID_OPERATION, functionName, "dimensions out of range");
+        if (width + xoffset > tex->getWidth(target, level)

[Zhenyao Mo, 2015/09/02 17:59:03]

You need to do overflow test here.  See Checked<> example in
validateCopyTexSubImage().

[yunchao, 2015/09/04 08:22:07]

Done.

+            || height + yoffset > tex->getHeight(target, level)) {
+            synthesizeGLError(GL_INVALID_VALUE, functionName, "dimensions out of range");
             return false;
         }
         return validateCompressedTexDimensions(functionName, TexSubImage2D, target, level, width, height, format);