Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(2628)

Unified Diff: gpu/command_buffer/service/gles2_cmd_decoder.cc

Issue 2683993002: Fix heap overflow caused by small buffer size (Closed)
Patch Set: Created 3 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: gpu/command_buffer/service/gles2_cmd_decoder.cc
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder.cc b/gpu/command_buffer/service/gles2_cmd_decoder.cc
index 3140d6f55dedf9f0609dc6705a4749d76afa771f..d05520b79f4dc329ba733347bbf4e946757f8c5a 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder.cc
+++ b/gpu/command_buffer/service/gles2_cmd_decoder.cc
@@ -14181,8 +14181,8 @@ void GLES2DecoderImpl::DoCopyTexImage2D(
target != GL_TEXTURE_CUBE_MAP_POSITIVE_X) {
for (int i = 0; i < 2; ++i) {
TextureManager::DoTexImageArguments args = {
- target, i, final_internal_format, 1, 1, 1, border,
- format, type, nullptr, 1, 0,
+ target, i, final_internal_format, width, height, 1, border,
+ format, type, nullptr, pixels_size, 0,
TextureManager::DoTexImageArguments::kTexImage2D };
texture_manager()->WorkaroundCopyTexImageCubeMap(&texture_state_,
&state_, &framebuffer_state_, texture_ref, func_name, args);
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698