command buffer: audit validation of ES3 commands (part 2)

gpu/command_buffer/service/gles2_cmd_decoder.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/gles2_cmd_decoder.h"
 
 #include <limits.h>
 #include <stddef.h>
 #include <stdint.h>
 #include <stdio.h>
@@ skipping 13404 matching lines @@
       &texture_state_, &state_, &framebuffer_state_, func_name, args);
 
   // This may be a slow command.  Exit command processing to allow for
   // context preemption and GPU watchdog checks.
   ExitCommandProcessingEarly();
   return error::kNoError;
 }
 
 error::Error GLES2DecoderImpl::HandleTexImage3D(uint32_t immediate_data_size,
                                                 const volatile void* cmd_data) {
-  if (!unsafe_es3_apis_enabled())
+  if (!feature_info_->IsWebGL2OrES3Context())
     return error::kUnknownCommand;
 
   const char* func_name = "glTexImage3D";
   const volatile gles2::cmds::TexImage3D& c =
       *static_cast<const volatile gles2::cmds::TexImage3D*>(cmd_data);
   TRACE_EVENT2("gpu", "GLES2DecoderImpl::HandleTexImage3D",
       "widthXheight", c.width * c.height, "depth", c.depth);
   // Set as failed for now, but if it successed, this will be set to not failed.
   texture_state_.tex_image_failed = true;
   GLenum target = static_cast<GLenum>(c.target);
@@ skipping 821 matching lines @@
 
   // This may be a slow command.  Exit command processing to allow for
   // context preemption and GPU watchdog checks.
   ExitCommandProcessingEarly();
   return error::kNoError;
 }
 
 error::Error GLES2DecoderImpl::HandleTexSubImage3D(
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
-  if (!unsafe_es3_apis_enabled())
+  if (!feature_info_->IsWebGL2OrES3Context())
     return error::kUnknownCommand;
 
   const char* func_name = "glTexSubImage3D";
   const volatile gles2::cmds::TexSubImage3D& c =
       *static_cast<const volatile gles2::cmds::TexSubImage3D*>(cmd_data);
   TRACE_EVENT2("gpu", "GLES2DecoderImpl::HandleTexSubImage3D",
       "widthXheight", c.width * c.height, "depth", c.depth);
   GLboolean internal = static_cast<GLboolean>(c.internal);
   if (internal == GL_TRUE && texture_state_.tex_image_failed)
     return error::kNoError;
@@ skipping 195 matching lines @@
                              &result_size)) {
     glGetUniformiv(
         service_id, real_location, result->GetData());
   }
   return error;
 }
 
 error::Error GLES2DecoderImpl::HandleGetUniformuiv(
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
-  if (!unsafe_es3_apis_enabled())
+  if (!feature_info_->IsWebGL2OrES3Context())
     return error::kUnknownCommand;
 
   const volatile gles2::cmds::GetUniformuiv& c =
       *static_cast<const volatile gles2::cmds::GetUniformuiv*>(cmd_data);
   GLuint program = c.program;
   GLint fake_location = c.location;
   GLuint service_id;
   GLenum result_type;
   GLsizei result_size;
   GLint real_location = -1;
@@ skipping 156 matching lines @@
   result->size = uniform_info->size;
   result->type = uniform_info->type;
   Bucket* bucket = CreateBucket(name_bucket_id);
   bucket->SetFromString(uniform_info->name.c_str());
   return error::kNoError;
 }
 
 error::Error GLES2DecoderImpl::HandleGetActiveUniformBlockiv(
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
-  if (!unsafe_es3_apis_enabled())
+  if (!feature_info_->IsWebGL2OrES3Context())
     return error::kUnknownCommand;
   const volatile gles2::cmds::GetActiveUniformBlockiv& c =
       *static_cast<const volatile gles2::cmds::GetActiveUniformBlockiv*>(
           cmd_data);
   GLuint program_id = c.program;
   GLuint index = static_cast<GLuint>(c.index);
   GLenum pname = static_cast<GLenum>(c.pname);
   Program* program = GetProgramInfoNotShader(
       program_id, "glGetActiveUniformBlockiv");
   if (!program) {
     return error::kNoError;
   }
   GLuint service_id = program->service_id();
   GLint link_status = GL_FALSE;
   glGetProgramiv(service_id, GL_LINK_STATUS, &link_status);
   if (link_status != GL_TRUE) {
     LOCAL_SET_GL_ERROR(GL_INVALID_OPERATION,
         "glGetActiveActiveUniformBlockiv", "program not linked");
     return error::kNoError;
   }
-  LOCAL_COPY_REAL_GL_ERRORS_TO_WRAPPER("GetActiveUniformBlockiv");
+  if (index >= program->uniform_block_size_info().size()) {
+    LOCAL_SET_GL_ERROR(GL_INVALID_VALUE, "glGetActiveUniformBlockiv",
+                       "uniformBlockIndex >= active uniform blocks");
+    return error::kNoError;
+  }
   GLsizei num_values = 1;
   if (pname == GL_UNIFORM_BLOCK_ACTIVE_UNIFORM_INDICES) {
     GLint num = 0;
     glGetActiveUniformBlockiv(
         service_id, index, GL_UNIFORM_BLOCK_ACTIVE_UNIFORMS, &num);
     GLenum error = glGetError();
     if (error != GL_NO_ERROR) {
       // Assume this will the same error if calling with pname.
       LOCAL_SET_GL_ERROR(error, "GetActiveUniformBlockiv", "");
       return error::kNoError;
     }
     num_values = static_cast<GLsizei>(num);
   }
   typedef cmds::GetActiveUniformBlockiv::Result Result;
   Result* result = GetSharedMemoryAs<Result*>(
       c.params_shm_id, c.params_shm_offset, Result::ComputeSize(num_values));
   GLint* params = result ? result->GetData() : NULL;
   if (params == NULL) {
     return error::kOutOfBounds;
   }
   // Check that the client initialized the result.
   if (result->size != 0) {
     return error::kInvalidArguments;
   }
   glGetActiveUniformBlockiv(service_id, index, pname, params);
-  GLenum error = glGetError();
-  if (error == GL_NO_ERROR) {
-    result->SetNumResults(num_values);
-  } else {
-    LOCAL_SET_GL_ERROR(error, "GetActiveUniformBlockiv", "");
-  }
+  result->SetNumResults(num_values);
   return error::kNoError;
 }
 
 error::Error GLES2DecoderImpl::HandleGetActiveUniformBlockName(
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
-  if (!unsafe_es3_apis_enabled())
+  if (!feature_info_->IsWebGL2OrES3Context())
     return error::kUnknownCommand;
   const volatile gles2::cmds::GetActiveUniformBlockName& c =
       *static_cast<const volatile gles2::cmds::GetActiveUniformBlockName*>(
           cmd_data);
   GLuint program_id = c.program;
   GLuint index = c.index;
   uint32_t name_bucket_id = c.name_bucket_id;
   typedef cmds::GetActiveUniformBlockName::Result Result;
   Result* result = GetSharedMemoryAs<Result*>(
       c.result_shm_id, c.result_shm_offset, sizeof(*result));
@@ skipping 10 matching lines @@
     return error::kNoError;
   }
   GLuint service_id = program->service_id();
   GLint link_status = GL_FALSE;
   glGetProgramiv(service_id, GL_LINK_STATUS, &link_status);
   if (link_status != GL_TRUE) {
     LOCAL_SET_GL_ERROR(GL_INVALID_OPERATION,
         "glGetActiveActiveUniformBlockName", "program not linked");
     return error::kNoError;
   }
+  if (index >= program->uniform_block_size_info().size()) {
+    LOCAL_SET_GL_ERROR(GL_INVALID_VALUE, "glGetActiveUniformBlockName",
+                       "uniformBlockIndex >= active uniform blocks");
+    return error::kNoError;
+  }
   GLint max_length = 0;
   glGetProgramiv(
       service_id, GL_ACTIVE_UNIFORM_BLOCK_MAX_NAME_LENGTH, &max_length);
   // Increase one so &buffer[0] is always valid.
   GLsizei buf_size = static_cast<GLsizei>(max_length) + 1;
   std::vector<char> buffer(buf_size);
   GLsizei length = 0;
   glGetActiveUniformBlockName(
       service_id, index, buf_size, &length, &buffer[0]);
   if (length == 0) {
     *result = 0;
     return error::kNoError;
   }
   *result = 1;
   Bucket* bucket = CreateBucket(name_bucket_id);
   DCHECK_GT(buf_size, length);
   DCHECK_EQ(0, buffer[length]);
   bucket->SetFromString(&buffer[0]);
   return error::kNoError;
 }
 
 error::Error GLES2DecoderImpl::HandleGetActiveUniformsiv(
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
-  if (!unsafe_es3_apis_enabled())
+  if (!feature_info_->IsWebGL2OrES3Context())
     return error::kUnknownCommand;
   const volatile gles2::cmds::GetActiveUniformsiv& c =
       *static_cast<const volatile gles2::cmds::GetActiveUniformsiv*>(cmd_data);
   GLuint program_id = c.program;
   GLenum pname = static_cast<GLenum>(c.pname);
   Bucket* bucket = GetBucket(c.indices_bucket_id);
   if (!bucket) {
     return error::kInvalidArguments;
   }
   if (!validators_->uniform_parameter.IsValid(pname)) {
@@ skipping 11 matching lines @@
   }
   // Check that the client initialized the result.
   if (result->size != 0) {
     return error::kInvalidArguments;
   }
   Program* program = GetProgramInfoNotShader(
       program_id, "glGetActiveUniformsiv");
   if (!program) {
     return error::kNoError;
   }
+  GLint activeUniforms = 0;
+  program->GetProgramiv(GL_ACTIVE_UNIFORMS, &activeUniforms);
+  for (int i = 0; i < count; i++) {
+    if (indices[i] >= static_cast<GLuint>(activeUniforms)) {
+      LOCAL_SET_GL_ERROR(GL_INVALID_VALUE,
+          "glGetActiveUniformsiv", "index >= active uniforms");
+      return error::kNoError;
+    }
+  }
   GLuint service_id = program->service_id();
   GLint link_status = GL_FALSE;
   glGetProgramiv(service_id, GL_LINK_STATUS, &link_status);
   if (link_status != GL_TRUE) {
     LOCAL_SET_GL_ERROR(GL_INVALID_OPERATION,
         "glGetActiveUniformsiv", "program not linked");
     return error::kNoError;
   }
-  LOCAL_COPY_REAL_GL_ERRORS_TO_WRAPPER("GetActiveUniformsiv");
   glGetActiveUniformsiv(service_id, count, indices, pname, params);
-  GLenum error = glGetError();
-  if (error == GL_NO_ERROR) {
-    result->SetNumResults(count);
-  } else {
-    LOCAL_SET_GL_ERROR(error, "GetActiveUniformsiv", "");
-  }
+  result->SetNumResults(count);
   return error::kNoError;
 }
 
 error::Error GLES2DecoderImpl::HandleGetActiveAttrib(
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
   const volatile gles2::cmds::GetActiveAttrib& c =
       *static_cast<const volatile gles2::cmds::GetActiveAttrib*>(cmd_data);
   GLuint program_id = c.program;
   GLuint index = c.index;
@@ skipping 3928 matching lines @@
 }
 
 // Include the auto-generated part of this file. We split this because it means
 // we can easily edit the non-auto generated parts right here in this file
 // instead of having to edit some template or the code generator.
 #include "base/macros.h"
 #include "gpu/command_buffer/service/gles2_cmd_decoder_autogen.h"
 
 }  // namespace gles2
 }  // namespace gpu