Explicitly validate sizes before allocating vectors.

gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc

 // Copyright (c) 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/gles2_cmd_decoder_passthrough.h"
 
 #include "base/strings/string_number_conversions.h"
 
 namespace gpu {
 namespace gles2 {
 
 namespace {
 
 template <typename ClientType, typename ServiceType, typename GenFunction>
 error::Error GenHelper(GLsizei n,
                        const volatile ClientType* client_ids,
                        ClientServiceMap<ClientType, ServiceType>* id_map,
                        GenFunction gen_function) {
+  DCHECK(n >= 0);
   std::vector<ClientType> client_ids_copy(client_ids, client_ids + n);
   for (GLsizei ii = 0; ii < n; ++ii) {
     if (id_map->GetServiceID(client_ids_copy[ii], nullptr)) {
       return error::kInvalidArguments;
     }
   }
   if (!CheckUniqueAndNonNullIds(n, client_ids_copy.data())) {
     return error::kInvalidArguments;
   }
 
@@ skipping 16 matching lines @@
   ServiceType service_id = create_function();
   id_map->SetIDMapping(client_id, service_id);
   return error::kNoError;
 }
 
 template <typename ClientType, typename ServiceType, typename DeleteFunction>
 error::Error DeleteHelper(GLsizei n,
                           const volatile ClientType* client_ids,
                           ClientServiceMap<ClientType, ServiceType>* id_map,
                           DeleteFunction delete_function) {
+  DCHECK(n >= 0);
   std::vector<ServiceType> service_ids(n, 0);
   for (GLsizei ii = 0; ii < n; ++ii) {
     ClientType client_id = client_ids[ii];
     service_ids[ii] = id_map->GetServiceIDOrInvalid(client_id);
     id_map->RemoveClientID(client_id);
   }
 
   delete_function(n, service_ids.data());
 
   return error::kNoError;
@@ skipping 503 matching lines @@
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoCullFace(GLenum mode) {
   glCullFace(mode);
   return error::kNoError;
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoDeleteBuffers(
     GLsizei n,
     const volatile GLuint* buffers) {
+  // DeleteHelper requires that n is non-negative because it allocates a copy of
+  // the IDs
+  if (n < 0) {
+    InsertError(GL_INVALID_VALUE, "n cannot be negative.");
+    return error::kNoError;
+  }
   return DeleteHelper(
       n, buffers, &resources_->buffer_id_map,
       [](GLsizei n, GLuint* buffers) { glDeleteBuffersARB(n, buffers); });
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoDeleteFramebuffers(
     GLsizei n,
     const volatile GLuint* framebuffers) {
+  // DeleteHelper requires that n is non-negative because it allocates a copy of
+  // the IDs
+  if (n < 0) {
+    InsertError(GL_INVALID_VALUE, "n cannot be negative.");
+    return error::kNoError;
+  }
   return DeleteHelper(n, framebuffers, &framebuffer_id_map_,
                       [](GLsizei n, GLuint* framebuffers) {
                         glDeleteFramebuffersEXT(n, framebuffers);
                       });
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoDeleteProgram(GLuint program) {
   return DeleteHelper(program, &resources_->program_id_map,
                       [](GLuint program) { glDeleteProgram(program); });
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoDeleteRenderbuffers(
     GLsizei n,
     const volatile GLuint* renderbuffers) {
+  // DeleteHelper requires that n is non-negative because it allocates a copy of
+  // the IDs
+  if (n < 0) {
+    InsertError(GL_INVALID_VALUE, "n cannot be negative.");
+    return error::kNoError;
+  }
   return DeleteHelper(n, renderbuffers, &resources_->renderbuffer_id_map,
                       [](GLsizei n, GLuint* renderbuffers) {
                         glDeleteRenderbuffersEXT(n, renderbuffers);
                       });
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoDeleteSamplers(
     GLsizei n,
     const volatile GLuint* samplers) {
+  // DeleteHelper requires that n is non-negative because it allocates a copy of
+  // the IDs
+  if (n < 0) {
+    InsertError(GL_INVALID_VALUE, "n cannot be negative.");
+    return error::kNoError;
+  }
   return DeleteHelper(
       n, samplers, &resources_->sampler_id_map,
       [](GLsizei n, GLuint* samplers) { glDeleteSamplers(n, samplers); });
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoDeleteSync(GLuint sync) {
   return DeleteHelper(sync, &resources_->sync_id_map, [](uintptr_t sync) {
     glDeleteSync(reinterpret_cast<GLsync>(sync));
   });
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoDeleteShader(GLuint shader) {
   return DeleteHelper(shader, &resources_->shader_id_map,
                       [](GLuint shader) { glDeleteShader(shader); });
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoDeleteTextures(
     GLsizei n,
     const volatile GLuint* textures) {
+  // DeleteHelper requires that n is non-negative because it allocates a copy of
+  // the IDs
+  if (n < 0) {
+    InsertError(GL_INVALID_VALUE, "n cannot be negative.");
+    return error::kNoError;
+  }
+
   // Textures that are currently associated with a mailbox are stored in the
   // texture_object_map_ and are deleted automatically when they are
   // unreferenced.  Only delete textures that are not in this map.
   std::vector<GLuint> non_mailbox_client_ids;
   for (GLsizei ii = 0; ii < n; ++ii) {
     GLuint client_id = textures[ii];
     auto texture_object_iter = resources_->texture_object_map.find(client_id);
     if (texture_object_iter == resources_->texture_object_map.end()) {
       // Delete with DeleteHelper
       non_mailbox_client_ids.push_back(client_id);
     } else {
       // Deleted when unreferenced
       resources_->texture_id_map.RemoveClientID(client_id);
       resources_->texture_object_map.erase(client_id);
     }
   }
   return DeleteHelper(
       non_mailbox_client_ids.size(), non_mailbox_client_ids.data(),
       &resources_->texture_id_map,
       [](GLsizei n, GLuint* textures) { glDeleteTextures(n, textures); });
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoDeleteTransformFeedbacks(
     GLsizei n,
     const volatile GLuint* ids) {
+  // DeleteHelper requires that n is non-negative because it allocates a copy of
+  // the IDs
+  if (n < 0) {
+    InsertError(GL_INVALID_VALUE, "n cannot be negative.");
+    return error::kNoError;
+  }
   return DeleteHelper(n, ids, &transform_feedback_id_map_,
                       [](GLsizei n, GLuint* transform_feedbacks) {
                         glDeleteTransformFeedbacks(n, transform_feedbacks);
                       });
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoDepthFunc(GLenum func) {
   glDepthFunc(func);
   return error::kNoError;
 }
@@ skipping 708 matching lines @@
 
 error::Error GLES2DecoderPassthroughImpl::DoHint(GLenum target, GLenum mode) {
   glHint(target, mode);
   return error::kNoError;
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoInvalidateFramebuffer(
     GLenum target,
     GLsizei count,
     const volatile GLenum* attachments) {
+  // Validate that count is non-negative before allocating a vector
+  if (count < 0) {
+    InsertError(GL_INVALID_VALUE, "count cannot be negative.");
+    return error::kNoError;
+  }
   std::vector<GLenum> attachments_copy(attachments, attachments + count);
   glInvalidateFramebuffer(target, count, attachments_copy.data());
   return error::kNoError;
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoInvalidateSubFramebuffer(
     GLenum target,
     GLsizei count,
     const volatile GLenum* attachments,
     GLint x,
     GLint y,
     GLsizei width,
     GLsizei height) {
+  // Validate that count is non-negative before allocating a vector
+  if (count < 0) {
+    InsertError(GL_INVALID_VALUE, "count cannot be negative.");
+    return error::kNoError;
+  }
   std::vector<GLenum> attachments_copy(attachments, attachments + count);
   glInvalidateSubFramebuffer(target, count, attachments_copy.data(), x, y,
                              width, height);
   return error::kNoError;
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoIsBuffer(GLuint buffer,
                                                      uint32_t* result) {
   NOTIMPLEMENTED();
   *result = glIsBuffer(GetBufferServiceID(buffer, resources_, false));
@@ skipping 838 matching lines @@
     GLsizei n,
     volatile GLuint* queries) {
   return GenHelper(n, queries, &query_id_map_, [](GLsizei n, GLuint* queries) {
     glGenQueries(n, queries);
   });
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoDeleteQueriesEXT(
     GLsizei n,
     const volatile GLuint* queries) {
+  // Validate n is non-negative before allcoating a vector of size n
+  if (n < 0) {
+    InsertError(GL_INVALID_VALUE, "count cannot be negative.");
+    return error::kNoError;
+  }
+
   std::vector<GLuint> queries_copy(queries, queries + n);
   // If any of these queries are pending or active, remove them from the lists
   for (GLuint query_client_id : queries_copy) {
     GLuint query_service_id = 0;
     if (!query_id_map_.GetServiceID(query_client_id, &query_service_id) ||
         query_service_id == 0) {
       continue;
     }
 
     QueryInfo query_info = query_info_map_[query_service_id];
@@ skipping 401 matching lines @@
     glGetTranslatedShaderSourceANGLE(service_id, translated_source_length,
                                      nullptr, buffer.data());
     *source = std::string(buffer.data());
   }
   return error::kNoError;
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoSwapBuffersWithBoundsCHROMIUM(
     GLsizei count,
     const volatile GLint* rects) {
+  if (count < 0) {
+    InsertError(GL_INVALID_VALUE, "count cannot be negative.");
+    return error::kNoError;
+  }
+
   std::vector<gfx::Rect> bounds(count);
   for (GLsizei i = 0; i < count; ++i) {
     bounds[i] = gfx::Rect(rects[i * 4 + 0], rects[i * 4 + 1], rects[i * 4 + 2],
                           rects[i * 4 + 3]);
   }
   gfx::SwapResult result = surface_->SwapBuffersWithBounds(bounds);
   if (result == gfx::SwapResult::SWAP_FAILED) {
     LOG(ERROR) << "Context lost because SwapBuffersWithBounds failed.";
   }
   // TODO(geofflang): force the context loss?
@@ skipping 244 matching lines @@
 
 error::Error GLES2DecoderPassthroughImpl::DoTraceEndCHROMIUM() {
   NOTIMPLEMENTED();
   return error::kNoError;
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoDiscardFramebufferEXT(
     GLenum target,
     GLsizei count,
     const volatile GLenum* attachments) {
+  // Validate that count is non-negative before allocating a vector
+  if (count < 0) {
+    InsertError(GL_INVALID_VALUE, "count cannot be negative.");
+    return error::kNoError;
+  }
   std::vector<GLenum> attachments_copy(attachments, attachments + count);
   glDiscardFramebufferEXT(target, count, attachments_copy.data());
   return error::kNoError;
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoLoseContextCHROMIUM(GLenum current,
                                                                 GLenum other) {
   NOTIMPLEMENTED();
   return error::kNoError;
 }
@@ skipping 19 matching lines @@
   }
   return wait_fence_sync_callback_.Run(namespace_id, command_buffer_id,
                                        release_count)
              ? error::kNoError
              : error::kDeferCommandUntilLater;
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoDrawBuffersEXT(
     GLsizei count,
     const volatile GLenum* bufs) {
+  // Validate that count is non-negative before allocating a vector
+  if (count < 0) {
+    InsertError(GL_INVALID_VALUE, "count cannot be negative.");
+    return error::kNoError;
+  }
   std::vector<GLenum> bufs_copy(bufs, bufs + count);
   glDrawBuffersARB(count, bufs_copy.data());
   return error::kNoError;
 }
 
 error::Error GLES2DecoderPassthroughImpl::DoDiscardBackbufferCHROMIUM() {
   NOTIMPLEMENTED();
   return error::kNoError;
 }
 
@@ skipping 336 matching lines @@
     GLuint texture,
     GLboolean promotion_hint,
     GLint display_x,
     GLint display_y) {
   NOTIMPLEMENTED();
   return error::kNoError;
 }
 
 }  // namespace gles2
 }  // namespace gpu