Add null checks to the parameters of glGet* calls.

gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc

 // Copyright (c) 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/gles2_cmd_decoder_passthrough.h"
 
 namespace gpu {
 namespace gles2 {
 
 // Custom Handlers
@@ skipping 210 matching lines @@
       *static_cast<const volatile gles2::cmds::GetActiveUniformBlockiv*>(
           cmd_data);
   GLuint program = static_cast<GLuint>(c.program);
   GLuint uniformBlockIndex = static_cast<GLuint>(c.index);
   GLenum pname = static_cast<GLenum>(c.pname);
   unsigned int buffer_size = 0;
   typedef cmds::GetActiveUniformBlockiv::Result Result;
   Result* result = GetSharedMemoryAndSizeAs<Result*>(
       c.params_shm_id, c.params_shm_offset, &buffer_size);
   GLint* params = result ? result->GetData() : NULL;
+  if (params == NULL) {
+    return error::kOutOfBounds;
+  }
   GLsizei bufsize = Result::ComputeMaxResults(buffer_size);
   GLsizei length = 0;
   error::Error error = DoGetActiveUniformBlockiv(
       program, uniformBlockIndex, pname, bufsize, &length, params);
   if (error != error::kNoError) {
     return error;
   }
   if (length > bufsize) {
     return error::kOutOfBounds;
   }
@@ skipping 197 matching lines @@
   const volatile gles2::cmds::GetInternalformativ& c =
       *static_cast<const volatile gles2::cmds::GetInternalformativ*>(cmd_data);
   GLenum target = static_cast<GLenum>(c.target);
   GLenum internalformat = static_cast<GLenum>(c.format);
   GLenum pname = static_cast<GLenum>(c.pname);
   unsigned int buffer_size = 0;
   typedef cmds::GetInternalformativ::Result Result;
   Result* result = GetSharedMemoryAndSizeAs<Result*>(
       c.params_shm_id, c.params_shm_offset, &buffer_size);
   GLint* params = result ? result->GetData() : NULL;
+  if (params == NULL) {
+    return error::kOutOfBounds;
+  }
   GLsizei bufsize = Result::ComputeMaxResults(buffer_size);
   GLsizei length = 0;
   error::Error error = DoGetInternalformativ(target, internalformat, pname,
                                              bufsize, &length, params);
   if (error != error::kNoError) {
     return error;
   }
   if (length > bufsize) {
     return error::kOutOfBounds;
   }
@@ skipping 186 matching lines @@
     const volatile void* cmd_data) {
   const volatile gles2::cmds::GetUniformfv& c =
       *static_cast<const volatile gles2::cmds::GetUniformfv*>(cmd_data);
   GLuint program = static_cast<GLuint>(c.program);
   GLint location = static_cast<GLint>(c.location);
   unsigned int buffer_size = 0;
   typedef cmds::GetUniformfv::Result Result;
   Result* result = GetSharedMemoryAndSizeAs<Result*>(
       c.params_shm_id, c.params_shm_offset, &buffer_size);
   GLfloat* params = result ? result->GetData() : NULL;
+  if (params == NULL) {
+    return error::kOutOfBounds;
+  }
   GLsizei bufsize = Result::ComputeMaxResults(buffer_size);
   GLsizei length = 0;
   error::Error error =
       DoGetUniformfv(program, location, bufsize, &length, params);
   if (error != error::kNoError) {
     return error;
   }
   if (length > bufsize) {
     return error::kOutOfBounds;
   }
   result->SetNumResults(length);
   return error::kNoError;
 }
 
 error::Error GLES2DecoderPassthroughImpl::HandleGetUniformiv(
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
   const volatile gles2::cmds::GetUniformiv& c =
       *static_cast<const volatile gles2::cmds::GetUniformiv*>(cmd_data);
   GLuint program = static_cast<GLuint>(c.program);
   GLint location = static_cast<GLint>(c.location);
   unsigned int buffer_size = 0;
   typedef cmds::GetUniformiv::Result Result;
   Result* result = GetSharedMemoryAndSizeAs<Result*>(
       c.params_shm_id, c.params_shm_offset, &buffer_size);
   GLint* params = result ? result->GetData() : NULL;
+  if (params == NULL) {
+    return error::kOutOfBounds;
+  }
   GLsizei bufsize = Result::ComputeMaxResults(buffer_size);
   GLsizei length = 0;
   error::Error error =
       DoGetUniformiv(program, location, bufsize, &length, params);
   if (error != error::kNoError) {
     return error;
   }
   if (length > bufsize) {
     return error::kOutOfBounds;
   }
   result->SetNumResults(length);
   return error::kNoError;
 }
 
 error::Error GLES2DecoderPassthroughImpl::HandleGetUniformuiv(
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
   const volatile gles2::cmds::GetUniformuiv& c =
       *static_cast<const volatile gles2::cmds::GetUniformuiv*>(cmd_data);
   GLuint program = static_cast<GLuint>(c.program);
   GLint location = static_cast<GLint>(c.location);
   unsigned int buffer_size = 0;
   typedef cmds::GetUniformuiv::Result Result;
   Result* result = GetSharedMemoryAndSizeAs<Result*>(
       c.params_shm_id, c.params_shm_offset, &buffer_size);
   GLuint* params = result ? result->GetData() : NULL;
+  if (params == NULL) {
+    return error::kOutOfBounds;
+  }
   GLsizei bufsize = Result::ComputeMaxResults(buffer_size);
   GLsizei length = 0;
   error::Error error =
       DoGetUniformuiv(program, location, bufsize, &length, params);
   if (error != error::kNoError) {
     return error;
   }
   if (length > bufsize) {
     return error::kOutOfBounds;
   }
@@ skipping 78 matching lines @@
   const volatile gles2::cmds::GetVertexAttribPointerv& c =
       *static_cast<const volatile gles2::cmds::GetVertexAttribPointerv*>(
           cmd_data);
   GLuint index = static_cast<GLuint>(c.index);
   GLenum pname = static_cast<GLenum>(c.pname);
   unsigned int buffer_size = 0;
   typedef cmds::GetVertexAttribPointerv::Result Result;
   Result* result = GetSharedMemoryAndSizeAs<Result*>(
       c.pointer_shm_id, c.pointer_shm_offset, &buffer_size);
   GLuint* params = result ? result->GetData() : NULL;
+  if (params == NULL) {
+    return error::kOutOfBounds;
+  }
   GLsizei bufsize = Result::ComputeMaxResults(buffer_size);
   GLsizei length = 0;
   error::Error error =
       DoGetVertexAttribPointerv(index, pname, bufsize, &length, params);
   if (error != error::kNoError) {
     return error;
   }
   if (length > bufsize) {
     return error::kOutOfBounds;
   }
@@ skipping 1790 matching lines @@
   // TODO(geofflang): Handle PIXEL_UNPACK_BUFFER case.
   const void* data = GetSharedMemoryAs<const void*>(
       c.data_shm_id, c.data_shm_offset, image_size);
   return DoCompressedTexSubImage3D(
       target, level, xoffset, yoffset, zoffset, width, height, depth,
       format, image_size, data);
 }
 
 }  // namespace gles2
 }  // namespace gpu