Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(61)

Unified Diff: gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc

Issue 2764403002: Make sure buffers are large enough to hold the Result structure. (Closed)
Patch Set: Created 3 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc b/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc
index fb3800c29fe69e22cda0b77bbe4d5164c00d9bab..e6a90bd794c380f7b25260d7a65b4f689428ca58 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc
+++ b/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc
@@ -226,7 +226,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleGetActiveUniformBlockiv(
unsigned int buffer_size = 0;
typedef cmds::GetActiveUniformBlockiv::Result Result;
Result* result = GetSharedMemoryAndSizeAs<Result*>(
- c.params_shm_id, c.params_shm_offset, &buffer_size);
+ c.params_shm_id, c.params_shm_offset, sizeof(Result), &buffer_size);
GLint* params = result ? result->GetData() : NULL;
if (params == NULL) {
return error::kOutOfBounds;
@@ -446,7 +446,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleGetInternalformativ(
unsigned int buffer_size = 0;
typedef cmds::GetInternalformativ::Result Result;
Result* result = GetSharedMemoryAndSizeAs<Result*>(
- c.params_shm_id, c.params_shm_offset, &buffer_size);
+ c.params_shm_id, c.params_shm_offset, sizeof(Result), &buffer_size);
GLint* params = result ? result->GetData() : NULL;
if (params == NULL) {
return error::kOutOfBounds;
@@ -655,7 +655,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleGetUniformfv(
unsigned int buffer_size = 0;
typedef cmds::GetUniformfv::Result Result;
Result* result = GetSharedMemoryAndSizeAs<Result*>(
- c.params_shm_id, c.params_shm_offset, &buffer_size);
+ c.params_shm_id, c.params_shm_offset, sizeof(Result), &buffer_size);
GLfloat* params = result ? result->GetData() : NULL;
if (params == NULL) {
return error::kOutOfBounds;
@@ -684,7 +684,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleGetUniformiv(
unsigned int buffer_size = 0;
typedef cmds::GetUniformiv::Result Result;
Result* result = GetSharedMemoryAndSizeAs<Result*>(
- c.params_shm_id, c.params_shm_offset, &buffer_size);
+ c.params_shm_id, c.params_shm_offset, sizeof(Result), &buffer_size);
GLint* params = result ? result->GetData() : NULL;
if (params == NULL) {
return error::kOutOfBounds;
@@ -713,7 +713,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleGetUniformuiv(
unsigned int buffer_size = 0;
typedef cmds::GetUniformuiv::Result Result;
Result* result = GetSharedMemoryAndSizeAs<Result*>(
- c.params_shm_id, c.params_shm_offset, &buffer_size);
+ c.params_shm_id, c.params_shm_offset, sizeof(Result), &buffer_size);
GLuint* params = result ? result->GetData() : NULL;
if (params == NULL) {
return error::kOutOfBounds;
@@ -814,7 +814,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleGetVertexAttribPointerv(
unsigned int buffer_size = 0;
typedef cmds::GetVertexAttribPointerv::Result Result;
Result* result = GetSharedMemoryAndSizeAs<Result*>(
- c.pointer_shm_id, c.pointer_shm_offset, &buffer_size);
+ c.pointer_shm_id, c.pointer_shm_offset, sizeof(Result), &buffer_size);
GLuint* params = result ? result->GetData() : NULL;
if (params == NULL) {
return error::kOutOfBounds;
@@ -863,7 +863,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleReadPixels(
unsigned int buffer_size = 0;
if (c.pixels_shm_id != 0) {
pixels = GetSharedMemoryAndSizeAs<uint8_t*>(
- c.pixels_shm_id, c.pixels_shm_offset, &buffer_size);
+ c.pixels_shm_id, c.pixels_shm_offset, 0, &buffer_size);
if (!pixels) {
return error::kOutOfBounds;
}
@@ -952,7 +952,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleTexImage2D(
if (pixels_shm_id != 0 || pixels_shm_offset != 0) {
pixels = GetSharedMemoryAndSizeAs<uint8_t*>(
- pixels_shm_id, pixels_shm_offset, &buffer_size);
+ pixels_shm_id, pixels_shm_offset, 0, &buffer_size);
if (!pixels) {
return error::kOutOfBounds;
}
@@ -990,7 +990,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleTexImage3D(
if (pixels_shm_id != 0 || pixels_shm_offset != 0) {
pixels = GetSharedMemoryAndSizeAs<uint8_t*>(
- pixels_shm_id, pixels_shm_offset, &buffer_size);
+ pixels_shm_id, pixels_shm_offset, 0, &buffer_size);
if (!pixels) {
return error::kOutOfBounds;
}
@@ -1027,7 +1027,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleTexSubImage2D(
if (pixels_shm_id != 0 || pixels_shm_offset != 0) {
pixels = GetSharedMemoryAndSizeAs<uint8_t*>(
- pixels_shm_id, pixels_shm_offset, &buffer_size);
+ pixels_shm_id, pixels_shm_offset, 0, &buffer_size);
if (!pixels) {
return error::kOutOfBounds;
}
@@ -1066,7 +1066,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleTexSubImage3D(
if (pixels_shm_id != 0 || pixels_shm_offset != 0) {
pixels = GetSharedMemoryAndSizeAs<uint8_t*>(
- pixels_shm_id, pixels_shm_offset, &buffer_size);
+ pixels_shm_id, pixels_shm_offset, 0, &buffer_size);
if (!pixels) {
return error::kOutOfBounds;
}
@@ -1903,7 +1903,7 @@ error::Error GLES2DecoderPassthroughImpl::HandlePathCommandsCHROMIUM(
if (coords_shm_id != 0 || coords_shm_offset != 0) {
unsigned int memory_size = 0;
coords = GetSharedMemoryAndSizeAs<const GLvoid*>(
- coords_shm_id, coords_shm_offset, &memory_size);
+ coords_shm_id, coords_shm_offset, 0, &memory_size);
coords_bufsize = static_cast<GLsizei>(memory_size);
}
@@ -2074,7 +2074,7 @@ GLES2DecoderPassthroughImpl::HandleStencilFillPathInstancedCHROMIUM(
if (paths_shm_id != 0 || paths_shm_offset != 0) {
unsigned int memory_size = 0;
paths = GetSharedMemoryAndSizeAs<const GLvoid*>(
- paths_shm_id, paths_shm_offset, &memory_size);
+ paths_shm_id, paths_shm_offset, 0, &memory_size);
paths_bufsize = static_cast<GLsizei>(memory_size);
}
@@ -2091,7 +2091,8 @@ GLES2DecoderPassthroughImpl::HandleStencilFillPathInstancedCHROMIUM(
if (c.transformValues_shm_id != 0 || c.transformValues_shm_offset != 0) {
unsigned int memory_size = 0;
transform_values = GetSharedMemoryAndSizeAs<const GLfloat*>(
- c.transformValues_shm_id, c.transformValues_shm_offset, &memory_size);
+ c.transformValues_shm_id, c.transformValues_shm_offset, 0,
+ &memory_size);
transform_values_bufsize = static_cast<GLsizei>(memory_size);
}
if (!transform_values) {
@@ -2126,7 +2127,7 @@ GLES2DecoderPassthroughImpl::HandleStencilStrokePathInstancedCHROMIUM(
if (paths_shm_id != 0 || paths_shm_offset != 0) {
unsigned int memory_size = 0;
paths = GetSharedMemoryAndSizeAs<const GLvoid*>(
- paths_shm_id, paths_shm_offset, &memory_size);
+ paths_shm_id, paths_shm_offset, 0, &memory_size);
paths_bufsize = static_cast<GLsizei>(memory_size);
}
@@ -2143,7 +2144,8 @@ GLES2DecoderPassthroughImpl::HandleStencilStrokePathInstancedCHROMIUM(
if (c.transformValues_shm_id != 0 || c.transformValues_shm_offset != 0) {
unsigned int memory_size = 0;
transform_values = GetSharedMemoryAndSizeAs<const GLfloat*>(
- c.transformValues_shm_id, c.transformValues_shm_offset, &memory_size);
+ c.transformValues_shm_id, c.transformValues_shm_offset, 0,
+ &memory_size);
transform_values_bufsize = static_cast<GLsizei>(memory_size);
}
if (!transform_values) {
@@ -2176,7 +2178,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleCoverFillPathInstancedCHROMIUM(
if (paths_shm_id != 0 || paths_shm_offset != 0) {
unsigned int memory_size = 0;
paths = GetSharedMemoryAndSizeAs<const GLvoid*>(
- paths_shm_id, paths_shm_offset, &memory_size);
+ paths_shm_id, paths_shm_offset, 0, &memory_size);
paths_bufsize = static_cast<GLsizei>(memory_size);
}
@@ -2192,7 +2194,8 @@ error::Error GLES2DecoderPassthroughImpl::HandleCoverFillPathInstancedCHROMIUM(
if (c.transformValues_shm_id != 0 || c.transformValues_shm_offset != 0) {
unsigned int memory_size = 0;
transform_values = GetSharedMemoryAndSizeAs<const GLfloat*>(
- c.transformValues_shm_id, c.transformValues_shm_offset, &memory_size);
+ c.transformValues_shm_id, c.transformValues_shm_offset, 0,
+ &memory_size);
transform_values_bufsize = static_cast<GLsizei>(memory_size);
}
if (!transform_values) {
@@ -2227,7 +2230,7 @@ GLES2DecoderPassthroughImpl::HandleCoverStrokePathInstancedCHROMIUM(
if (paths_shm_id != 0 || paths_shm_offset != 0) {
unsigned int memory_size = 0;
paths = GetSharedMemoryAndSizeAs<const GLvoid*>(
- paths_shm_id, paths_shm_offset, &memory_size);
+ paths_shm_id, paths_shm_offset, 0, &memory_size);
paths_bufsize = static_cast<GLsizei>(memory_size);
}
@@ -2243,7 +2246,8 @@ GLES2DecoderPassthroughImpl::HandleCoverStrokePathInstancedCHROMIUM(
if (c.transformValues_shm_id != 0 || c.transformValues_shm_offset != 0) {
unsigned int memory_size = 0;
transform_values = GetSharedMemoryAndSizeAs<const GLfloat*>(
- c.transformValues_shm_id, c.transformValues_shm_offset, &memory_size);
+ c.transformValues_shm_id, c.transformValues_shm_offset, 0,
+ &memory_size);
transform_values_bufsize = static_cast<GLsizei>(memory_size);
}
if (!transform_values) {
@@ -2277,7 +2281,7 @@ GLES2DecoderPassthroughImpl::HandleStencilThenCoverFillPathInstancedCHROMIUM(
if (paths_shm_id != 0 || paths_shm_offset != 0) {
unsigned int memory_size = 0;
paths = GetSharedMemoryAndSizeAs<const GLvoid*>(
- paths_shm_id, paths_shm_offset, &memory_size);
+ paths_shm_id, paths_shm_offset, 0, &memory_size);
paths_bufsize = static_cast<GLsizei>(memory_size);
}
@@ -2295,7 +2299,8 @@ GLES2DecoderPassthroughImpl::HandleStencilThenCoverFillPathInstancedCHROMIUM(
if (c.transformValues_shm_id != 0 || c.transformValues_shm_offset != 0) {
unsigned int memory_size = 0;
transform_values = GetSharedMemoryAndSizeAs<const GLfloat*>(
- c.transformValues_shm_id, c.transformValues_shm_offset, &memory_size);
+ c.transformValues_shm_id, c.transformValues_shm_offset, 0,
+ &memory_size);
transform_values_bufsize = static_cast<GLsizei>(memory_size);
}
if (!transform_values) {
@@ -2330,7 +2335,7 @@ GLES2DecoderPassthroughImpl::HandleStencilThenCoverStrokePathInstancedCHROMIUM(
if (paths_shm_id != 0 || paths_shm_offset != 0) {
unsigned int memory_size = 0;
paths = GetSharedMemoryAndSizeAs<const GLvoid*>(
- paths_shm_id, paths_shm_offset, &memory_size);
+ paths_shm_id, paths_shm_offset, 0, &memory_size);
paths_bufsize = static_cast<GLsizei>(memory_size);
}
@@ -2348,7 +2353,8 @@ GLES2DecoderPassthroughImpl::HandleStencilThenCoverStrokePathInstancedCHROMIUM(
if (c.transformValues_shm_id != 0 || c.transformValues_shm_offset != 0) {
unsigned int memory_size = 0;
transform_values = GetSharedMemoryAndSizeAs<const GLfloat*>(
- c.transformValues_shm_id, c.transformValues_shm_offset, &memory_size);
+ c.transformValues_shm_id, c.transformValues_shm_offset, 0,
+ &memory_size);
transform_values_bufsize = static_cast<GLsizei>(memory_size);
}
if (!transform_values) {
@@ -2409,7 +2415,7 @@ GLES2DecoderPassthroughImpl::HandleProgramPathFragmentInputGenCHROMIUM(
if (c.coeffs_shm_id != 0 || c.coeffs_shm_offset != 0) {
unsigned int memory_size = 0;
coeffs = GetSharedMemoryAndSizeAs<const GLfloat*>(
- c.coeffs_shm_id, c.coeffs_shm_offset, &memory_size);
+ c.coeffs_shm_id, c.coeffs_shm_offset, 0, &memory_size);
coeffs_bufsize = static_cast<GLsizei>(memory_size);
}
if (!coeffs) {

Powered by Google App Engine
This is Rietveld 408576698