Validate pixel data array is enough for request by texImage3D and texSubImage3D

third_party/WebKit/Source/platform/graphics/gpu/WebGLImageConversion.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "platform/graphics/gpu/WebGLImageConversion.h"
 
 #include "platform/CheckedInt.h"
 #include "platform/graphics/ImageObserver.h"
 #include "platform/graphics/cpu/arm/WebGLImageConversionNEON.h"
@@ skipping 1958 matching lines @@
     case GL_HALF_FLOAT:
     case GL_HALF_FLOAT_OES: // OES_texture_half_float
         *bytesPerComponent = sizeof(GLushort);
         break;
     default:
         return false;
     }
     return true;
 }
 
-GLenum WebGLImageConversion::computeImageSizeInBytes(GLenum format, GLenum type, GLsizei width, GLsizei height, GLint alignment, unsigned* imageSizeInBytes, unsigned* paddingInBytes)
+GLenum WebGLImageConversion::computeImageSizeInBytes(GLenum format, GLenum type, GLsizei width, GLsizei height, GLsizei depth, GLint alignment, unsigned* imageSizeInBytes, unsigned* paddingInBytes)
 {
     ASSERT(imageSizeInBytes);
     ASSERT(alignment == 1 || alignment == 2 || alignment == 4 || alignment == 8);
-    if (width < 0 || height < 0)
+    if (width < 0 || height < 0 || depth < 0)
         return GL_INVALID_VALUE;
     unsigned bytesPerComponent, componentsPerPixel;
     if (!computeFormatAndTypeParameters(format, type, &bytesPerComponent, &componentsPerPixel))
         return GL_INVALID_ENUM;
-    if (!width || !height) {
+    if (!width || !height || !depth) {
         *imageSizeInBytes = 0;
         if (paddingInBytes)
             *paddingInBytes = 0;
         return GL_NO_ERROR;
     }
     CheckedInt<uint32_t> checkedValue(bytesPerComponent * componentsPerPixel);
     checkedValue *=  width;
     if (!checkedValue.isValid())
         return GL_INVALID_VALUE;
     unsigned validRowSize = checkedValue.value();
     unsigned padding = 0;
     unsigned residual = validRowSize % alignment;
     if (residual) {
         padding = alignment - residual;
         checkedValue += padding;
     }
     // Last row needs no padding.
     checkedValue *= (height - 1);
     checkedValue += validRowSize;
     if (!checkedValue.isValid())
         return GL_INVALID_VALUE;
+    checkedValue *= depth;
+    if (!checkedValue.isValid())
+        return GL_INVALID_VALUE;

[Zhenyao Mo, 2015/11/12 11:31:52]

Another issue: see above, "last row needs no padding".  Now every last row in
every 2d image have no padding, but my understanding is only the last row of the
last 2d image has no padding.

[qiankun, 2015/11/13 08:29:59]

Done.

     *imageSizeInBytes = checkedValue.value();
     if (paddingInBytes)
         *paddingInBytes = padding;
     return GL_NO_ERROR;
 }
 
 WebGLImageConversion::ImageExtractor::ImageExtractor(Image* image, ImageHtmlDomSource imageHtmlDomSource, bool premultiplyAlpha, bool ignoreGammaAndColorProfile)
 {
     m_image = image;
     m_imageHtmlDomSource = imageHtmlDomSource;
@@ skipping 179 matching lines @@
     unsigned width,
     unsigned height,
     unsigned sourceUnpackAlignment,
     Vector<uint8_t>& data)
 {
     if (!pixels)
         return false;
 
     unsigned packedSize;
     // Output data is tightly packed (alignment == 1).
-    if (computeImageSizeInBytes(format, type, width, height, 1, &packedSize, 0) != GL_NO_ERROR)
+    if (computeImageSizeInBytes(format, type, width, height, 1, 1, &packedSize, 0) != GL_NO_ERROR)
         return false;
     data.resize(packedSize);
 
     if (!packPixels(reinterpret_cast<const uint8_t*>(pixels), sourceFormat, width, height, sourceUnpackAlignment, format, type, alphaOp, data.data(), flipY))
         return false;
     if (ImageObserver *observer = image->imageObserver())
         observer->didDraw(image);
     return true;
 }
 
 bool WebGLImageConversion::extractImageData(
     const uint8_t* imageData,
     const IntSize& imageDataSize,
     GLenum format,
     GLenum type,
     bool flipY,
     bool premultiplyAlpha,
     Vector<uint8_t>& data)
 {
     if (!imageData)
         return false;
     int width = imageDataSize.width();
     int height = imageDataSize.height();
 
     unsigned packedSize;
     // Output data is tightly packed (alignment == 1).
-    if (computeImageSizeInBytes(format, type, width, height, 1, &packedSize, 0) != GL_NO_ERROR)
+    if (computeImageSizeInBytes(format, type, width, height, 1, 1, &packedSize, 0) != GL_NO_ERROR)
         return false;
     data.resize(packedSize);
 
     if (!packPixels(imageData, DataFormatRGBA8, width, height, 0, format, type, premultiplyAlpha ? AlphaDoPremultiply : AlphaDoNothing, data.data(), flipY))
         return false;
 
     return true;
 }
 
 bool WebGLImageConversion::extractTextureData(
@@ skipping 60 matching lines @@
     }
 
     FormatConverter converter(width, height, sourceData, destinationData, srcStride, dstStride);
     converter.convert(sourceDataFormat, dstDataFormat, alphaOp);
     if (!converter.Success())
         return false;
     return true;
 }
 
 } // namespace blink