Validate pixel data array is enough for request by texImage3D and texSubImage3D

third_party/WebKit/Source/platform/graphics/gpu/WebGLImageConversion.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "platform/graphics/gpu/WebGLImageConversion.h"
 
 #include "platform/CheckedInt.h"
 #include "platform/graphics/ImageObserver.h"
 #include "platform/graphics/cpu/arm/WebGLImageConversionNEON.h"
@@ skipping 1958 matching lines @@
     case GL_HALF_FLOAT:
     case GL_HALF_FLOAT_OES: // OES_texture_half_float
         *bytesPerComponent = sizeof(GLushort);
         break;
     default:
         return false;
     }
     return true;
 }
 
-GLenum WebGLImageConversion::computeImageSizeInBytes(GLenum format, GLenum type, GLsizei width, GLsizei height, GLint alignment, unsigned* imageSizeInBytes, unsigned* paddingInBytes)
+GLenum WebGLImageConversion::computeImageSizeInBytes(GLenum format, GLenum type, GLsizei width, GLsizei height, GLsizei depth, GLint alignment, unsigned* imageSizeInBytes, unsigned* paddingInBytes)
 {
     ASSERT(imageSizeInBytes);
     ASSERT(alignment == 1 || alignment == 2 || alignment == 4 || alignment == 8);
-    if (width < 0 || height < 0)
+    if (width < 0 || height < 0 || depth < 0)
         return GL_INVALID_VALUE;
     unsigned bytesPerComponent, componentsPerPixel;
     if (!computeFormatAndTypeParameters(format, type, &bytesPerComponent, &componentsPerPixel))
         return GL_INVALID_ENUM;
-    if (!width || !height) {
+    if (!width || !height || !depth) {
         *imageSizeInBytes = 0;
         if (paddingInBytes)
             *paddingInBytes = 0;
         return GL_NO_ERROR;
     }
     CheckedInt<uint32_t> checkedValue(bytesPerComponent * componentsPerPixel);
     checkedValue *=  width;
     if (!checkedValue.isValid())
         return GL_INVALID_VALUE;
     unsigned validRowSize = checkedValue.value();
     unsigned padding = 0;
     unsigned residual = validRowSize % alignment;
     if (residual) {
         padding = alignment - residual;
         checkedValue += padding;
     }
     // Last row needs no padding.
-    checkedValue *= (height - 1);
+    checkedValue *= (height * depth - 1);

[Ken Russell (switch to Gerrit), 2015/11/20 00:15:42]

More changes are needed to this function in order to make it correct for ES 3.0,
because many more pixel storage parameters are exposed: UNPACK_ROW_LENGTH,
UNPACK_SKIP_ROWS, UNPACK_SKIP_PIXELS, UNPACK_IMAGE_HEIGHT, and
UNPACK_SKIP_IMAGES. Will you continue working on making this function more
correct, and adding more tests?

     checkedValue += validRowSize;
     if (!checkedValue.isValid())
         return GL_INVALID_VALUE;
     *imageSizeInBytes = checkedValue.value();
     if (paddingInBytes)
         *paddingInBytes = padding;
     return GL_NO_ERROR;
 }
 
 WebGLImageConversion::ImageExtractor::ImageExtractor(Image* image, ImageHtmlDomSource imageHtmlDomSource, bool premultiplyAlpha, bool ignoreGammaAndColorProfile)
@@ skipping 182 matching lines @@
     unsigned width,
     unsigned height,
     unsigned sourceUnpackAlignment,
     Vector<uint8_t>& data)
 {
     if (!pixels)
         return false;
 
     unsigned packedSize;
     // Output data is tightly packed (alignment == 1).
-    if (computeImageSizeInBytes(format, type, width, height, 1, &packedSize, 0) != GL_NO_ERROR)
+    if (computeImageSizeInBytes(format, type, width, height, 1, 1, &packedSize, 0) != GL_NO_ERROR)
         return false;
     data.resize(packedSize);
 
     if (!packPixels(reinterpret_cast<const uint8_t*>(pixels), sourceFormat, width, height, sourceUnpackAlignment, format, type, alphaOp, data.data(), flipY))
         return false;
     if (ImageObserver *observer = image->imageObserver())
         observer->didDraw(image);
     return true;
 }
 
 bool WebGLImageConversion::extractImageData(
     const uint8_t* imageData,
     const IntSize& imageDataSize,
     GLenum format,
     GLenum type,
     bool flipY,
     bool premultiplyAlpha,
     Vector<uint8_t>& data)
 {
     if (!imageData)
         return false;
     int width = imageDataSize.width();
     int height = imageDataSize.height();
 
     unsigned packedSize;
     // Output data is tightly packed (alignment == 1).
-    if (computeImageSizeInBytes(format, type, width, height, 1, &packedSize, 0) != GL_NO_ERROR)
+    if (computeImageSizeInBytes(format, type, width, height, 1, 1, &packedSize, 0) != GL_NO_ERROR)
         return false;
     data.resize(packedSize);
 
     if (!packPixels(imageData, DataFormatRGBA8, width, height, 0, format, type, premultiplyAlpha ? AlphaDoPremultiply : AlphaDoNothing, data.data(), flipY))
         return false;
 
     return true;
 }
 
 bool WebGLImageConversion::extractTextureData(
@@ skipping 60 matching lines @@
     }
 
     FormatConverter converter(width, height, sourceData, destinationData, srcStride, dstStride);
     converter.convert(sourceDataFormat, dstDataFormat, alphaOp);
     if (!converter.Success())
         return false;
     return true;
 }
 
 } // namespace blink