Supress integer-overflow in TexSubImage2D(3D)Impl

gpu/command_buffer/client/gles2_implementation.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // A class to emulate GLES2 over command buffers.
 
 #include "gpu/command_buffer/client/gles2_implementation.h"
 
 #include <GLES2/gl2.h>
 #include <GLES2/gl2ext.h>
 #include <GLES2/gl2extchromium.h>
 #include <GLES3/gl3.h>
 #include <stddef.h>
 #include <stdint.h>
 #include <algorithm>
 #include <map>
 #include <set>
 #include <sstream>
 #include <string>
 #include "base/atomic_sequence_num.h"
 #include "base/compiler_specific.h"
+#include "base/numerics/safe_math.h"
 #include "base/strings/string_split.h"
 #include "base/strings/stringprintf.h"
 #include "base/sys_info.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/trace_event/memory_allocator_dump.h"
 #include "base/trace_event/memory_dump_manager.h"
 #include "base/trace_event/process_memory_dump.h"
 #include "base/trace_event/trace_event.h"
 #include "gpu/command_buffer/client/buffer_tracker.h"
 #include "gpu/command_buffer/client/gles2_cmd_helper.h"
@@ skipping 3027 matching lines @@
     GLint num_rows = ComputeNumRowsThatFitInBuffer(
         buffer_padded_row_size, unpadded_row_size, buffer->size(), height);
     num_rows = std::min(num_rows, height);
     CopyRectToBuffer(
         source, num_rows, unpadded_row_size, pixels_padded_row_size,
         buffer->address(), buffer_padded_row_size);
     helper_->TexSubImage2D(
         target, level, xoffset, yoffset, width, num_rows, format, type,
         buffer->shm_id(), buffer->offset(), internal);
     buffer->Release();
-    yoffset += num_rows;
+    base::CheckedNumeric<GLint> updated_yoffset = yoffset;
+    updated_yoffset += num_rows;
+    if (!updated_yoffset.IsValid()) {
+      SetGLError(GL_INVALID_VALUE, "TexSubImage2DImpl",
+          "yoffset + height overflows");

[piman, 2016/09/07 17:48:18]

Here and other places: we should return early and avoid issuing invalid
TexSubImage2DImpl. In particular it is not legitimate to write to yoffset=0 in
case of overflow, if the original request did not include those texels.

Technically, if we issue a GL error, we should not be filling any texel at all.
Could we check this overflow before calling TexSubImage2DImpl? Is there any case
where we would overflow here but not by checking overflow of yoffset+height?

+    }
+    yoffset = updated_yoffset.ValueOrDefault(0);
     source += num_rows * pixels_padded_row_size;
     height -= num_rows;
   }
 }
 
 void GLES2Implementation::TexSubImage3DImpl(GLenum target,
                                             GLint level,
                                             GLint xoffset,
                                             GLint yoffset,
                                             GLsizei zoffset,
@@ skipping 70 matching lines @@
         CopyRectToBuffer(
             source + ii * image_size_src, my_height, unpadded_row_size,
             pixels_padded_row_size, buffer_pointer + ii * image_size_dst,
             buffer_padded_row_size);
       }
     } else {
       CopyRectToBuffer(
           source, my_height, unpadded_row_size, pixels_padded_row_size,
           buffer->address(), buffer_padded_row_size);
     }
+    base::CheckedNumeric<GLint> updated_yoffset = yoffset;
+    updated_yoffset += row_index;
+    if (!updated_yoffset.IsValid()) {
+      SetGLError(GL_INVALID_VALUE, "TexSubImage3DImpl",
+          "yoffset + row_index overflows");

[Zhenyao Mo, 2016/09/07 17:39:23]

row_index and depth_index below are internal implementation details.  You should
use height and depth instead.

+    }
+    base::CheckedNumeric<GLint> updated_zoffset = zoffset;
+    updated_zoffset += depth_index;
+    if (!updated_zoffset.IsValid()) {
+      SetGLError(GL_INVALID_VALUE, "TexSubImage3DImpl",
+          "zoffset + depth_index overflows");
+    }
     helper_->TexSubImage3D(
-        target, level, xoffset, yoffset + row_index, zoffset + depth_index,
-        width, my_height, my_depth,
+        target, level, xoffset, updated_yoffset.ValueOrDefault(0),
+        updated_zoffset.ValueOrDefault(0), width, my_height, my_depth,
         format, type, buffer->shm_id(), buffer->offset(), internal);
     buffer->Release();
 
     total_rows -= num_rows;
     if (total_rows > 0) {
       GLint num_image_paddings;
       if (num_images > 0) {
         DCHECK_EQ(row_index, 0);
         depth_index += num_images;
         num_image_paddings = num_images;
@@ skipping 3722 matching lines @@
   cached_extensions_.clear();
 }
 
 // Include the auto-generated part of this file. We split this because it means
 // we can easily edit the non-auto generated parts right here in this file
 // instead of having to edit some template or the code generator.
 #include "gpu/command_buffer/client/gles2_implementation_impl_autogen.h"
 
 }  // namespace gles2
 }  // namespace gpu