command buffer: audit validation of ES3 commands (part 3)

gpu/command_buffer/service/gles2_cmd_decoder.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/gles2_cmd_decoder.h"
 
 #include <limits.h>
 #include <stddef.h>
 #include <stdint.h>
 #include <stdio.h>
@@ skipping 15197 matching lines @@
   if (!program || !program->IsValid()) {
     return error::kNoError;
   }
   program->GetProgramInfo(program_manager(), bucket);
   return error::kNoError;
 }
 
 error::Error GLES2DecoderImpl::HandleGetUniformBlocksCHROMIUM(
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
-  if (!unsafe_es3_apis_enabled())
+  if (!feature_info_->IsWebGL2OrES3Context())
     return error::kUnknownCommand;
   const volatile gles2::cmds::GetUniformBlocksCHROMIUM& c =
       *static_cast<const volatile gles2::cmds::GetUniformBlocksCHROMIUM*>(
           cmd_data);
   GLuint program_id = static_cast<GLuint>(c.program);
   uint32_t bucket_id = c.bucket_id;
   Bucket* bucket = CreateBucket(bucket_id);
   bucket->SetSize(sizeof(UniformBlocksHeader));  // in case we fail.
   Program* program = NULL;
   program = GetProgram(program_id);
   if (!program || !program->IsValid()) {
     return error::kNoError;
   }
   program->GetUniformBlocks(bucket);
   return error::kNoError;
 }
 
 error::Error GLES2DecoderImpl::HandleGetUniformsES3CHROMIUM(
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
-  if (!unsafe_es3_apis_enabled())
+  if (!feature_info_->IsWebGL2OrES3Context())
     return error::kUnknownCommand;
   const volatile gles2::cmds::GetUniformsES3CHROMIUM& c =
       *static_cast<const volatile gles2::cmds::GetUniformsES3CHROMIUM*>(
           cmd_data);
   GLuint program_id = static_cast<GLuint>(c.program);
   uint32_t bucket_id = c.bucket_id;
   Bucket* bucket = CreateBucket(bucket_id);
   bucket->SetSize(sizeof(UniformsES3Header));  // in case we fail.
   Program* program = NULL;
   program = GetProgram(program_id);
   if (!program || !program->IsValid()) {
     return error::kNoError;
   }
   program->GetUniformsES3(bucket);
   return error::kNoError;
 }
 
 error::Error GLES2DecoderImpl::HandleGetTransformFeedbackVarying(
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
-  if (!unsafe_es3_apis_enabled())
+  if (!feature_info_->IsWebGL2OrES3Context())
     return error::kUnknownCommand;
   const volatile gles2::cmds::GetTransformFeedbackVarying& c =
       *static_cast<const volatile gles2::cmds::GetTransformFeedbackVarying*>(
           cmd_data);
   GLuint program_id = c.program;
   GLuint index = c.index;
   uint32_t name_bucket_id = c.name_bucket_id;
   typedef cmds::GetTransformFeedbackVarying::Result Result;
   Result* result = GetSharedMemoryAs<Result*>(
       c.result_shm_id, c.result_shm_offset, sizeof(*result));
@@ skipping 10 matching lines @@
     return error::kNoError;
   }
   GLuint service_id = program->service_id();
   GLint link_status = GL_FALSE;
   glGetProgramiv(service_id, GL_LINK_STATUS, &link_status);
   if (link_status != GL_TRUE) {
     LOCAL_SET_GL_ERROR(GL_INVALID_OPERATION,
         "glGetTransformFeedbackVarying", "program not linked");
     return error::kNoError;
   }
+  GLint num_varyings = 0;
+  glGetProgramiv(service_id, GL_TRANSFORM_FEEDBACK_VARYINGS, &num_varyings);
+  if (index >= static_cast<GLuint>(num_varyings)) {
+    LOCAL_SET_GL_ERROR(GL_INVALID_VALUE,
+        "glGetTransformFeedbackVarying", "index out of bounds");
+    return error::kNoError;
+  }
   GLint max_length = 0;
   glGetProgramiv(
       service_id, GL_TRANSFORM_FEEDBACK_VARYING_MAX_LENGTH, &max_length);
   max_length = std::max(1, max_length);
   std::vector<char> buffer(max_length);
   GLsizei length = 0;
   GLsizei size = 0;
   GLenum type = 0;
-  LOCAL_COPY_REAL_GL_ERRORS_TO_WRAPPER("GetTransformFeedbackVarying");
   glGetTransformFeedbackVarying(
       service_id, index, max_length, &length, &size, &type, &buffer[0]);
-  GLenum error = glGetError();
-  if (error != GL_NO_ERROR) {
-    LOCAL_SET_GL_ERROR(error, "glGetTransformFeedbackVarying", "");
-    return error::kNoError;
-  }
   result->success = 1;  // true.
   result->size = static_cast<int32_t>(size);
   result->type = static_cast<uint32_t>(type);
   Bucket* bucket = CreateBucket(name_bucket_id);
   DCHECK(length >= 0 && length < max_length);
   buffer[length] = '\0';  // Just to be safe.
   bucket->SetFromString(&buffer[0]);
   return error::kNoError;
 }
 
 error::Error GLES2DecoderImpl::HandleGetTransformFeedbackVaryingsCHROMIUM(
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
-  if (!unsafe_es3_apis_enabled())
+  if (!feature_info_->IsWebGL2OrES3Context())
     return error::kUnknownCommand;
   const volatile gles2::cmds::GetTransformFeedbackVaryingsCHROMIUM& c =
       *static_cast<
           const volatile gles2::cmds::GetTransformFeedbackVaryingsCHROMIUM*>(
           cmd_data);
   GLuint program_id = static_cast<GLuint>(c.program);
   uint32_t bucket_id = c.bucket_id;
   Bucket* bucket = CreateBucket(bucket_id);
   bucket->SetSize(sizeof(TransformFeedbackVaryingsHeader));  // in case we fail.
   Program* program = NULL;
@@ skipping 1808 matching lines @@
   memcpy(target_matrix, kIdentityMatrix, sizeof(kIdentityMatrix));
   // The matrix_mode is either GL_PATH_MODELVIEW_NV or GL_PATH_PROJECTION_NV
   // since the values of the _NV and _CHROMIUM tokens match.
   glMatrixLoadIdentityEXT(matrix_mode);
 }
 
 error::Error GLES2DecoderImpl::HandleUniformBlockBinding(
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
   const char* func_name = "glUniformBlockBinding";
-  if (!unsafe_es3_apis_enabled())
+  if (!feature_info_->IsWebGL2OrES3Context())
     return error::kUnknownCommand;
   const volatile gles2::cmds::UniformBlockBinding& c =
       *static_cast<const volatile gles2::cmds::UniformBlockBinding*>(cmd_data);
   GLuint client_id = c.program;
   GLuint index = static_cast<GLuint>(c.index);
   GLuint binding = static_cast<GLuint>(c.binding);
   Program* program = GetProgramInfoNotShader(client_id, func_name);
   if (!program) {
     return error::kNoError;
   }
@@ skipping 10 matching lines @@
   GLuint service_id = program->service_id();
   glUniformBlockBinding(service_id, index, binding);
   program->SetUniformBlockBinding(index, binding);
   return error::kNoError;
 }
 
 error::Error GLES2DecoderImpl::HandleClientWaitSync(
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
   const char* function_name = "glClientWaitSync";
-  if (!unsafe_es3_apis_enabled())
+  if (!feature_info_->IsWebGL2OrES3Context())
     return error::kUnknownCommand;
   const volatile gles2::cmds::ClientWaitSync& c =
       *static_cast<const volatile gles2::cmds::ClientWaitSync*>(cmd_data);
   const GLuint sync = static_cast<GLuint>(c.sync);
   GLbitfield flags = static_cast<GLbitfield>(c.flags);
   const GLuint64 timeout = c.timeout();
   typedef cmds::ClientWaitSync::Result Result;
   Result* result_dst = GetSharedMemoryAs<Result*>(
       c.result_shm_id, c.result_shm_offset, sizeof(*result_dst));
   if (!result_dst) {
@@ skipping 28 matching lines @@
       NOTREACHED();
       break;
   }
   *result_dst = status;
   return error::kNoError;
 }
 
 error::Error GLES2DecoderImpl::HandleWaitSync(uint32_t immediate_data_size,
                                               const volatile void* cmd_data) {
   const char* function_name = "glWaitSync";
-  if (!unsafe_es3_apis_enabled())
+  if (!feature_info_->IsWebGL2OrES3Context())
     return error::kUnknownCommand;
   const volatile gles2::cmds::WaitSync& c =
       *static_cast<const volatile gles2::cmds::WaitSync*>(cmd_data);
   const GLuint sync = static_cast<GLuint>(c.sync);
   const GLbitfield flags = static_cast<GLbitfield>(c.flags);
   const GLuint64 timeout = c.timeout();
   GLsync service_sync = 0;
   if (!group_->GetSyncServiceId(sync, &service_sync)) {
     LOCAL_SET_GL_ERROR(GL_INVALID_VALUE, function_name, "invalid sync");
     return error::kNoError;
@@ skipping 19 matching lines @@
   if (flags != 0) {
     LOCAL_SET_GL_ERROR(GL_INVALID_VALUE, function_name, "invalid flags");
     return 0;
   }
   return glFenceSync(condition, flags);
 }
 
 error::Error GLES2DecoderImpl::HandleGetInternalformativ(
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
-  if (!unsafe_es3_apis_enabled())
+  if (!feature_info_->IsWebGL2OrES3Context())
     return error::kUnknownCommand;
   const volatile gles2::cmds::GetInternalformativ& c =
       *static_cast<const volatile gles2::cmds::GetInternalformativ*>(cmd_data);
   GLenum target = static_cast<GLenum>(c.target);
   GLenum format = static_cast<GLenum>(c.format);
   GLenum pname = static_cast<GLenum>(c.pname);
   if (!validators_->render_buffer_target.IsValid(target)) {
     LOCAL_SET_GL_ERROR_INVALID_ENUM("glGetInternalformativ", target, "target");
     return error::kNoError;
   }
   if (!validators_->render_buffer_format.IsValid(format)) {
-    LOCAL_SET_GL_ERROR_INVALID_ENUM("glGetInternalformativ", format, "format");
+    LOCAL_SET_GL_ERROR_INVALID_ENUM("glGetInternalformativ", format,
+                                    "internalformat");
     return error::kNoError;
   }
   if (!validators_->internal_format_parameter.IsValid(pname)) {
     LOCAL_SET_GL_ERROR_INVALID_ENUM("glGetInternalformativ", pname, "pname");
     return error::kNoError;
   }
 
   typedef cmds::GetInternalformativ::Result Result;
   GLsizei num_values = 0;
   std::vector<GLint> samples;
@@ skipping 44 matching lines @@
   // Check that the client initialized the result.
   if (result->size != 0) {
     return error::kInvalidArguments;
   }
   if (gl_version_info().IsLowerThanGL(4, 2)) {
     switch (pname) {
       case GL_NUM_SAMPLE_COUNTS:
         params[0] = static_cast<GLint>(samples.size());
         break;
       case GL_SAMPLES:
-        for (size_t ii = 0; ii < samples.size(); ++ii) {
-          params[ii] = samples[ii];
+        {
+          // TODO(kainino): should add a test for this code if it's kept

[Kai Ninomiya, 2016/11/01 01:40:29]

Need to resolve this before committing.

+          size_t copyCount = std::min(
+              samples.size(), static_cast<size_t>(result->GetNumResults()));

[piman, 2016/11/01 02:38:15]

Drive-by: you don't want to read result->GetNumResults(), it's not set yet (set
on l.17364) and even if it was set, it would be a security issue.

|result| resides in shared memory, which is writable by the client. The
(untrusted) client could race and modify this value between when it's set and
when it's read here, meaning we would use a totally untrusted value.

You can use num_values instead. But then again, samples.size() == num_values in
the GL_SAMPLES case, so this logic is not needed.
The code on l.17332 made sure the result contains space for num_values entries.

+          for (size_t ii = 0; ii < copyCount; ++ii) {
+            params[ii] = samples[ii];
+          }
         }
         break;
       default:
         NOTREACHED();
         break;
     }
   } else {
     glGetInternalformativ(target, format, pname, num_values, params);
   }
   result->SetNumResults(num_values);
   return error::kNoError;
 }
 
 error::Error GLES2DecoderImpl::HandleMapBufferRange(
     uint32_t immediate_data_size, const volatile void* cmd_data) {
-  if (!unsafe_es3_apis_enabled()) {
+  if (!feature_info_->IsWebGL2OrES3Context()) {
     return error::kUnknownCommand;
   }
 
   const char* func_name = "glMapBufferRange";
   const volatile gles2::cmds::MapBufferRange& c =
       *static_cast<const volatile gles2::cmds::MapBufferRange*>(cmd_data);
   GLenum target = static_cast<GLenum>(c.target);
   GLbitfield access = static_cast<GLbitfield>(c.access);
   GLintptr offset = static_cast<GLintptr>(c.offset);
   GLsizeiptr size = static_cast<GLsizeiptr>(c.size);
@@ skipping 90 matching lines @@
                          static_cast<unsigned int>(data_shm_offset));
   if ((access & GL_MAP_INVALIDATE_RANGE_BIT) == 0) {
     memcpy(mem, ptr, size);
   }
   *result = 1;
   return error::kNoError;
 }
 
 error::Error GLES2DecoderImpl::HandleUnmapBuffer(
     uint32_t immediate_data_size, const volatile void* cmd_data) {
-  if (!unsafe_es3_apis_enabled()) {
+  if (!feature_info_->IsWebGL2OrES3Context()) {
     return error::kUnknownCommand;
   }
   const char* func_name = "glUnmapBuffer";
 
   const volatile gles2::cmds::UnmapBuffer& c =
       *static_cast<const volatile gles2::cmds::UnmapBuffer*>(cmd_data);
   GLenum target = static_cast<GLenum>(c.target);
 
   if (!validators_->buffer_target.IsValid(target)) {
     LOCAL_SET_GL_ERROR_INVALID_ENUM(func_name, target, "target");
@@ skipping 1275 matching lines @@
 }
 
 // Include the auto-generated part of this file. We split this because it means
 // we can easily edit the non-auto generated parts right here in this file
 // instead of having to edit some template or the code generator.
 #include "base/macros.h"
 #include "gpu/command_buffer/service/gles2_cmd_decoder_autogen.h"
 
 }  // namespace gles2
 }  // namespace gpu