Patch the results of queries that return object IDs in the passthrough cmd decoder.

gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc

Index: gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc b/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc
index 840e1bd70881dc8830b4caab471db35c6eba5853..b5afd494937cc0ea6d9c535816252721a3db285d 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc
+++ b/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc
@@ -875,7 +875,7 @@ error::Error GLES2DecoderPassthroughImpl::DoGetBooleanv(GLenum pname,
                                                         GLsizei* length,
                                                         GLboolean* params) {
   glGetBooleanvRobustANGLE(pname, bufsize, length, params);
-  return error::kNoError;
+  return PatchGetNumericResults(pname, *length, params);

[piman, 2016/11/16 18:55:22]

This makes me uncomfortable. params is in shared memory, controlled by the
untrusted client. It was written by glGetBooleanvRobustANGLE, but by the time
it's read by PatchGetNumericResults it could have been modified by the
(malicious) client, so PatchGetNumericResults has to defend against this. Also
it means the client could temporarily see the service ids, which is an
information leak (though probably harmless?)

How hard would it be to have the glGet's query into local memory, patch there,
and upon success copy into the shared memory?

[Geoff Lang, 2016/11/17 19:35:01]

Good point, I didn't think about these being in shmem.  Updated to do the
queries and patching in a scratch buffer and then copy the results to the shmem.
 Added a test that goes through these code paths.

 }
 
 error::Error GLES2DecoderPassthroughImpl::DoGetBufferParameteri64v(
@@ -908,7 +908,7 @@ error::Error GLES2DecoderPassthroughImpl::DoGetFloatv(GLenum pname,
                                                       GLsizei* length,
                                                       GLfloat* params) {
   glGetFloatvRobustANGLE(pname, bufsize, length, params);
-  return error::kNoError;
+  return PatchGetNumericResults(pname, *length, params);
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoGetFragDataLocation(
@@ -928,7 +928,8 @@ error::Error GLES2DecoderPassthroughImpl::DoGetFramebufferAttachmentParameteriv(
     GLint* params) {
   glGetFramebufferAttachmentParameterivRobustANGLE(target, attachment, pname,
                                                    bufsize, length, params);
-  return error::kNoError;
+  return PatchGetFramebufferAttachmentParameter(target, attachment, pname,
+                                                *length, params);
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoGetInteger64v(GLenum pname,
@@ -936,7 +937,7 @@ error::Error GLES2DecoderPassthroughImpl::DoGetInteger64v(GLenum pname,
                                                           GLsizei* length,
                                                           GLint64* params) {
   glGetInteger64vRobustANGLE(pname, bufsize, length, params);
-  return error::kNoError;
+  return PatchGetNumericResults(pname, *length, params);
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoGetIntegeri_v(GLenum pname,
@@ -962,7 +963,7 @@ error::Error GLES2DecoderPassthroughImpl::DoGetIntegerv(GLenum pname,
                                                         GLsizei* length,
                                                         GLint* params) {
   glGetIntegervRobustANGLE(pname, bufsize, length, params);
-  return error::kNoError;
+  return PatchGetNumericResults(pname, *length, params);
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoGetInternalformativ(GLenum target,