Patch the results of queries that return object IDs in the passthrough cmd decoder.

gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc

 // Copyright (c) 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/gles2_cmd_decoder_passthrough.h"
 
 #include "base/strings/string_number_conversions.h"
 
 namespace gpu {
 namespace gles2 {
@@ skipping 857 matching lines @@
                                                               GLint* result) {
   NOTIMPLEMENTED();
   return error::kNoError;
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoGetBooleanv(GLenum pname,
                                                         GLsizei bufsize,
                                                         GLsizei* length,
                                                         GLboolean* params) {
   glGetBooleanvRobustANGLE(pname, bufsize, length, params);
-  return error::kNoError;
+  return PatchGetNumericResults(pname, *length, params);

[piman, 2016/11/16 18:55:22]

This makes me uncomfortable. params is in shared memory, controlled by the
untrusted client. It was written by glGetBooleanvRobustANGLE, but by the time
it's read by PatchGetNumericResults it could have been modified by the
(malicious) client, so PatchGetNumericResults has to defend against this. Also
it means the client could temporarily see the service ids, which is an
information leak (though probably harmless?)

How hard would it be to have the glGet's query into local memory, patch there,
and upon success copy into the shared memory?

[Geoff Lang, 2016/11/17 19:35:01]

Good point, I didn't think about these being in shmem.  Updated to do the
queries and patching in a scratch buffer and then copy the results to the shmem.
 Added a test that goes through these code paths.

 }
 
 error::Error GLES2DecoderPassthroughImpl::DoGetBufferParameteri64v(
     GLenum target,
     GLenum pname,
     GLsizei bufsize,
     GLsizei* length,
     GLint64* params) {
   glGetBufferParameteri64vRobustANGLE(target, pname, bufsize, length, params);
   return error::kNoError;
@@ skipping 12 matching lines @@
 error::Error GLES2DecoderPassthroughImpl::DoGetError(uint32_t* result) {
   *result = glGetError();
   return error::kNoError;
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoGetFloatv(GLenum pname,
                                                       GLsizei bufsize,
                                                       GLsizei* length,
                                                       GLfloat* params) {
   glGetFloatvRobustANGLE(pname, bufsize, length, params);
-  return error::kNoError;
+  return PatchGetNumericResults(pname, *length, params);
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoGetFragDataLocation(
     GLuint program,
     const char* name,
     GLint* result) {
   NOTIMPLEMENTED();
   return error::kNoError;
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoGetFramebufferAttachmentParameteriv(
     GLenum target,
     GLenum attachment,
     GLenum pname,
     GLsizei bufsize,
     GLsizei* length,
     GLint* params) {
   glGetFramebufferAttachmentParameterivRobustANGLE(target, attachment, pname,
                                                    bufsize, length, params);
-  return error::kNoError;
+  return PatchGetFramebufferAttachmentParameter(target, attachment, pname,
+                                                *length, params);
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoGetInteger64v(GLenum pname,
                                                           GLsizei bufsize,
                                                           GLsizei* length,
                                                           GLint64* params) {
   glGetInteger64vRobustANGLE(pname, bufsize, length, params);
-  return error::kNoError;
+  return PatchGetNumericResults(pname, *length, params);
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoGetIntegeri_v(GLenum pname,
                                                           GLuint index,
                                                           GLsizei bufsize,
                                                           GLsizei* length,
                                                           GLint* data) {
   glGetIntegeri_vRobustANGLE(pname, index, bufsize, length, data);
   return error::kNoError;
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoGetInteger64i_v(GLenum pname,
                                                             GLuint index,
                                                             GLsizei bufsize,
                                                             GLsizei* length,
                                                             GLint64* data) {
   glGetInteger64i_vRobustANGLE(pname, index, bufsize, length, data);
   return error::kNoError;
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoGetIntegerv(GLenum pname,
                                                         GLsizei bufsize,
                                                         GLsizei* length,
                                                         GLint* params) {
   glGetIntegervRobustANGLE(pname, bufsize, length, params);
-  return error::kNoError;
+  return PatchGetNumericResults(pname, *length, params);
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoGetInternalformativ(GLenum target,
                                                                 GLenum format,
                                                                 GLenum pname,
                                                                 GLsizei bufSize,
                                                                 GLsizei* length,
                                                                 GLint* params) {
   glGetInternalformativRobustANGLE(target, format, pname, bufSize, length,
                                    params);
@@ skipping 2043 matching lines @@
 GLES2DecoderPassthroughImpl::DoUniformMatrix4fvStreamTextureMatrixCHROMIUM(
     GLint location,
     GLboolean transpose,
     const volatile GLfloat* defaultValue) {
   NOTIMPLEMENTED();
   return error::kNoError;
 }
 
 }  // namespace gles2
 }  // namespace gpu