A potential use of uninitialized data on buggy driver impl.

gpu/command_buffer/service/gles2_cmd_decoder.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/gles2_cmd_decoder.h"
 
 #include <limits.h>
 #include <stddef.h>
 #include <stdint.h>
 #include <stdio.h>
@@ skipping 6867 matching lines @@
     return GL_POINT_SIZE_RANGE;
   }
   return pname;
 }
 
 void GLES2DecoderImpl::DoGetBooleanv(GLenum pname,
                                      GLboolean* params,
                                      GLsizei params_size) {
   DCHECK(params);
   std::unique_ptr<GLint[]> values(new GLint[params_size]);
+  memset(values.get(), 0, params_size * sizeof(GLint));
   DoGetIntegerv(pname, values.get(), params_size);
   for (GLsizei ii = 0; ii < params_size; ++ii) {
     params[ii] = static_cast<GLboolean>(values[ii]);
   }
 }
 
 void GLES2DecoderImpl::DoGetFloatv(GLenum pname,
                                    GLfloat* params,
                                    GLsizei params_size) {
   DCHECK(params);
   GLsizei num_written = 0;
   if (state_.GetStateAsGLfloat(pname, params, &num_written)) {
     DCHECK_EQ(num_written, params_size);
     return;
   }
 
   switch (pname) {
     case GL_ALIASED_POINT_SIZE_RANGE:
     case GL_ALIASED_LINE_WIDTH_RANGE:
     case GL_MAX_TEXTURE_MAX_ANISOTROPY_EXT:
       DCHECK_EQ(params_size, util_.GLGetNumValuesReturned(pname));
       pname = AdjustGetPname(pname);
       glGetFloatv(pname, params);
       return;
   }
 
   std::unique_ptr<GLint[]> values(new GLint[params_size]);
+  memset(values.get(), 0, params_size * sizeof(GLint));
   DoGetIntegerv(pname, values.get(), params_size);
   for (GLsizei ii = 0; ii < params_size; ++ii) {
     params[ii] = static_cast<GLfloat>(values[ii]);
   }
 }
 
 void GLES2DecoderImpl::DoGetInteger64v(GLenum pname,
                                        GLint64* params,
                                        GLsizei params_size) {
   DCHECK(params);
@@ skipping 10 matching lines @@
           if (params) {
             *params = std::numeric_limits<unsigned int>::max();
           }
         }
         return;
       }
     }
   }
 
   std::unique_ptr<GLint[]> values(new GLint[params_size]);
+  memset(values.get(), 0, params_size * sizeof(GLint));
   DoGetIntegerv(pname, values.get(), params_size);
   for (GLsizei ii = 0; ii < params_size; ++ii) {
     params[ii] = static_cast<GLint64>(values[ii]);
   }
 }
 
 void GLES2DecoderImpl::DoGetIntegerv(GLenum pname,
                                      GLint* params,
                                      GLsizei params_size) {
   DCHECK(params);
@@ skipping 12352 matching lines @@
 }
 
 // Include the auto-generated part of this file. We split this because it means
 // we can easily edit the non-auto generated parts right here in this file
 // instead of having to edit some template or the code generator.
 #include "base/macros.h"
 #include "gpu/command_buffer/service/gles2_cmd_decoder_autogen.h"
 
 }  // namespace gles2
 }  // namespace gpu