(Reland)WebGL 2: validate uniform block index

third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "modules/webgl/WebGL2RenderingContextBase.h"
 
 #include "bindings/modules/v8/WebGLAny.h"
 #include "core/html/HTMLCanvasElement.h"
 #include "core/html/HTMLImageElement.h"
@@ skipping 2298 matching lines @@
 GLuint WebGL2RenderingContextBase::getUniformBlockIndex(WebGLProgram* program, const String& uniformBlockName)
 {
     if (isContextLost() || !validateWebGLObject("getUniformBlockIndex", program))
         return 0;
     if (!validateString("getUniformBlockIndex", uniformBlockName))
         return 0;
 
     return webContext()->getUniformBlockIndex(objectOrZero(program), uniformBlockName.utf8().data());
 }
 
+bool WebGL2RenderingContextBase::validateUniformBlockIndex(const char* functionName, WebGLProgram* program, GLuint blockIndex)
+{
+    GLint activeUniformBlocks = 0;
+    webContext()->getProgramiv(objectOrZero(program), GL_ACTIVE_UNIFORM_BLOCKS, &activeUniformBlocks);
+    if (blockIndex >= static_cast<GLuint>(activeUniformBlocks)) {
+        synthesizeGLError(GL_INVALID_VALUE, functionName, "invalid uniform block index");
+        return false;
+    }
+    return true;
+}
+
 ScriptValue WebGL2RenderingContextBase::getActiveUniformBlockParameter(ScriptState* scriptState, WebGLProgram* program, GLuint uniformBlockIndex, GLenum pname)
 {
     if (isContextLost() || !validateWebGLObject("getActiveUniformBlockParameter", program))
         return ScriptValue::createNull(scriptState);
 
+    if (!validateUniformBlockIndex("getActiveUniformBlockParameter", program, uniformBlockIndex))
+        return ScriptValue::createNull(scriptState);
+
     switch (pname) {
     case GL_UNIFORM_BLOCK_BINDING:
     case GL_UNIFORM_BLOCK_DATA_SIZE:
     case GL_UNIFORM_BLOCK_ACTIVE_UNIFORMS:
         {
             GLint intValue = 0;
             webContext()->getActiveUniformBlockiv(objectOrZero(program), uniformBlockIndex, pname, &intValue);
             return WebGLAny(scriptState, static_cast<unsigned>(intValue));
         }
     case GL_UNIFORM_BLOCK_ACTIVE_UNIFORM_INDICES:
@@ skipping 16 matching lines @@
         synthesizeGLError(GL_INVALID_ENUM, "getActiveUniformBlockParameter", "invalid parameter name");
         return ScriptValue::createNull(scriptState);
     }
 }
 
 String WebGL2RenderingContextBase::getActiveUniformBlockName(WebGLProgram* program, GLuint uniformBlockIndex)
 {
     if (isContextLost() || !validateWebGLObject("getActiveUniformBlockName", program))
         return String();
 
+    if (!validateUniformBlockIndex("getActiveUniformBlockName", program, uniformBlockIndex))
+        return String();
+
     GLint maxNameLength = -1;
     webContext()->getProgramiv(objectOrZero(program), GL_ACTIVE_UNIFORM_BLOCK_MAX_NAME_LENGTH, &maxNameLength);
     if (maxNameLength <= 0) {
         // This state indicates that there are no active uniform blocks
         synthesizeGLError(GL_INVALID_VALUE, "getActiveUniformBlockName", "invalid uniform block index");
         return String();
     }
     OwnPtr<GLchar[]> name = adoptArrayPtr(new GLchar[maxNameLength]);
     GLsizei length;
     webContext()->getActiveUniformBlockName(objectOrZero(program), uniformBlockIndex, maxNameLength, &length, name.get());
     return String(name.get(), length);
 }
 
 void WebGL2RenderingContextBase::uniformBlockBinding(WebGLProgram* program, GLuint uniformBlockIndex, GLuint uniformBlockBinding)
 {
     if (isContextLost() || !validateWebGLObject("uniformBlockBinding", program))
         return;
 
+    if (!validateUniformBlockIndex("uniformBlockBinding", program, uniformBlockIndex))
+        return;
+
     webContext()->uniformBlockBinding(objectOrZero(program), uniformBlockIndex, uniformBlockBinding);
 }
 
 WebGLVertexArrayObject* WebGL2RenderingContextBase::createVertexArray()
 {
     if (isContextLost())
         return nullptr;
 
     WebGLVertexArrayObject* o = WebGLVertexArrayObject::create(this, WebGLVertexArrayObjectBase::VaoTypeUser);
     addContextObject(o);
@@ skipping 891 matching lines @@
 GLenum WebGL2RenderingContextBase::boundFramebufferColorFormat()
 {
     if (m_readFramebufferBinding && m_readFramebufferBinding->object())
         return m_readFramebufferBinding->colorBufferFormat();
     if (m_requestedAttributes.alpha())
         return GL_RGBA;
     return GL_RGB;
 }
 
 } // namespace blink