add range check to service-side MapBufferRange

gpu/command_buffer/service/gles2_cmd_decoder.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/gles2_cmd_decoder.h"
 
 #include <limits.h>
 #include <stddef.h>
 #include <stdint.h>
 #include <stdio.h>
@@ skipping 16818 matching lines @@
   if ((access & mask) == mask) {
     LOCAL_SET_GL_ERROR(GL_INVALID_OPERATION, "MapBufferRange",
                        "incompatible access bits");
     return error::kNoError;
   }
   access = (access & ~GL_MAP_UNSYNCHRONIZED_BIT);
   if ((access & GL_MAP_WRITE_BIT) == GL_MAP_WRITE_BIT &&
       (access & GL_MAP_INVALIDATE_RANGE_BIT) == 0) {
     access = (access | GL_MAP_READ_BIT);
   }
+  Buffer* buffer = buffer_manager()->GetBufferInfoForTarget(&state_, target);
+  if (!buffer) {
+    LOCAL_SET_GL_ERROR(GL_INVALID_OPERATION, "MapBufferRange",
+                       "no buffer bound to target");
+    return error::kNoError;
+  }
+  if (!buffer->CheckRange(offset, size)) {
+    LOCAL_SET_GL_ERROR(GL_INVALID_VALUE, "MapBufferRange",
+                       "invalid range");
+    return error::kNoError;
+  }
   void* ptr = glMapBufferRange(target, offset, size, access);
   if (ptr == nullptr) {
     return error::kNoError;
   }
-  Buffer* buffer = buffer_manager()->GetBufferInfoForTarget(&state_, target);
-  DCHECK(buffer);
   buffer->SetMappedRange(offset, size, access, ptr,
                          GetSharedMemoryBuffer(data_shm_id));
   if ((access & GL_MAP_INVALIDATE_RANGE_BIT) == 0) {
     memcpy(mem, ptr, size);
   }
   *result = 1;
   return error::kNoError;
 }
 
 error::Error GLES2DecoderImpl::HandleUnmapBuffer(
@@ skipping 1245 matching lines @@
 }
 
 // Include the auto-generated part of this file. We split this because it means
 // we can easily edit the non-auto generated parts right here in this file
 // instead of having to edit some template or the code generator.
 #include "base/macros.h"
 #include "gpu/command_buffer/service/gles2_cmd_decoder_autogen.h"
 
 }  // namespace gles2
 }  // namespace gpu