WebGL: validations and fixes to avoid buffer/texture overflow

Source/modules/webgl/WebGLRenderingContextBase.cpp

Index: Source/modules/webgl/WebGLRenderingContextBase.cpp
diff --git a/Source/modules/webgl/WebGLRenderingContextBase.cpp b/Source/modules/webgl/WebGLRenderingContextBase.cpp
index 5537d3c461d564e6be604000577721674abe0cb2..6e2e716e43a1eb68dddf9295ec1247d6d12bc217 100644
--- a/Source/modules/webgl/WebGLRenderingContextBase.cpp
+++ b/Source/modules/webgl/WebGLRenderingContextBase.cpp
@@ -1625,6 +1625,10 @@ void WebGLRenderingContextBase::bufferSubDataImpl(GLenum target, long long offse
         return;
     if (!data)
         return;
+    if (offset + static_cast<long long>(size) > buffer->getSize()) {
+        synthesizeGLError(GL_INVALID_VALUE, "bufferSubData", "buffer overflow");
+        return;
+    }
 
     webContext()->bufferSubData(target, static_cast<GLintptr>(offset), size, data);
 }
@@ -5897,9 +5901,13 @@ bool WebGLRenderingContextBase::validateCompressedTexSubDimensions(const char* f
             synthesizeGLError(GL_INVALID_OPERATION, functionName, "xoffset or yoffset not multiple of 4");
             return false;
         }
-        if (width - xoffset > tex->getWidth(target, level)
-            || height - yoffset > tex->getHeight(target, level)) {
-            synthesizeGLError(GL_INVALID_OPERATION, functionName, "dimensions out of range");
+        // Before checking if it is in the range, check if overflow happens first.
+        Checked<GLint, RecordOverflow> maxX = xoffset, maxY = yoffset;
+        maxX += width;
+        maxY += height;
+        if (maxX.hasOverflowed() || maxY.hasOverflowed() || maxX.unsafeGet() > tex->getWidth(target, level)
+            || maxY.unsafeGet() > tex->getHeight(target, level)) {
+            synthesizeGLError(GL_INVALID_VALUE, functionName, "dimensions out of range");
             return false;
         }
         return validateCompressedTexDimensions(functionName, TexSubImage2D, target, level, width, height, format);