Supress integer-overflow in TexSubImage2D(3D)Impl

gpu/command_buffer/client/gles2_implementation.cc

Index: gpu/command_buffer/client/gles2_implementation.cc
diff --git a/gpu/command_buffer/client/gles2_implementation.cc b/gpu/command_buffer/client/gles2_implementation.cc
index aa3b18d4e783c28b8bb69de4ca9198c64856346c..6fa03a58af192359a8b3297dae523c127f5d7312 100644
--- a/gpu/command_buffer/client/gles2_implementation.cc
+++ b/gpu/command_buffer/client/gles2_implementation.cc
@@ -19,6 +19,7 @@
 #include <string>
 #include "base/atomic_sequence_num.h"
 #include "base/compiler_specific.h"
+#include "base/numerics/safe_math.h"
 #include "base/strings/string_split.h"
 #include "base/strings/stringprintf.h"
 #include "base/sys_info.h"
@@ -3066,7 +3067,9 @@ void GLES2Implementation::TexSubImage2DImpl(GLenum target,
         target, level, xoffset, yoffset, width, num_rows, format, type,
         buffer->shm_id(), buffer->offset(), internal);
     buffer->Release();
-    yoffset += num_rows;
+    base::CheckedNumeric<GLint> updated_yoffset = yoffset;
+    updated_yoffset += num_rows;
+    yoffset = updated_yoffset.ValueOrDefault(GL_INVALID_VALUE);

[Zhenyao Mo, 2016/09/07 17:05:33]

You misunderstood me.

It should be

if (!updated_yoffset.valid()) {
   SetGLError(GL_INVALID_VALUE, function_name, "yoffset + height overflow");
}
yoffset = updated_yoffset.ValueOrDefault(0);

[xidachen, 2016/09/07 17:36:39]

Done.

     source += num_rows * pixels_padded_row_size;
     height -= num_rows;
   }
@@ -3157,8 +3160,14 @@ void GLES2Implementation::TexSubImage3DImpl(GLenum target,
           source, my_height, unpadded_row_size, pixels_padded_row_size,
           buffer->address(), buffer_padded_row_size);
     }
+    base::CheckedNumeric<GLint> updated_yoffset = yoffset;
+    base::CheckedNumeric<GLint> updated_zoffset = zoffset;
+    updated_yoffset += row_index;
+    updated_zoffset += depth_index;
     helper_->TexSubImage3D(
-        target, level, xoffset, yoffset + row_index, zoffset + depth_index,
+        target, level, xoffset,
+        updated_yoffset.ValueOrDefault(GL_INVALID_VALUE),
+        updated_zoffset.ValueOrDefault(GL_INVALID_VALUE),

[Zhenyao Mo, 2016/09/07 17:05:34]

Same here.

[xidachen, 2016/09/07 17:36:38]

Done.

         width, my_height, my_depth,
         format, type, buffer->shm_id(), buffer->offset(), internal);
     buffer->Release();