Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(586)

Issue 2826143003: Passthrough CmdDecoder: Use robust CompressedTex(Sub)Image (Closed)

Created:
3 years, 8 months ago by Corentin Wallez
Modified:
3 years, 8 months ago
CC:
chromium-reviews, piman+watch_chromium.org
Target Ref:
refs/heads/master
Project:
chromium
Visibility:
Public.

Description

Passthrough CmdDecoder: Use robust CompressedTex(Sub)Image A compromised renderer would have been able to crash ANGLE by sending a 0 shmem ID and non 0 shmem offset for CompressedTex(Sub)Image commands, with no unpack buffer bound. Use the newly added RobustANGLE entry points that check enough data is passed. BUG=chromium:602688 CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel Review-Url: https://codereview.chromium.org/2826143003 Cr-Commit-Position: refs/heads/master@{#466042} Committed: https://chromium.googlesource.com/chromium/src/+/7cc769d230580677418d35623a89fc6ae60c7167

Patch Set 1 #

Total comments: 2

Patch Set 2 : Manually add glCompressedTexSubImage3DRobustANGLE to gl_mack.h because it has more than the 10 args… #

Unified diffs Side-by-side diffs Delta from patch set Stats (+709 lines, -19 lines) Patch
M gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc View 4 chunks +12 lines, -16 lines 0 comments Download
M ui/gl/generate_bindings.py View 1 chunk +29 lines, -0 lines 0 comments Download
M ui/gl/gl_bindings_api_autogen_gl.h View 4 chunks +41 lines, -0 lines 0 comments Download
M ui/gl/gl_bindings_autogen_gl.h View 10 chunks +100 lines, -0 lines 0 comments Download
M ui/gl/gl_bindings_autogen_gl.cc View 18 chunks +308 lines, -0 lines 0 comments Download
M ui/gl/gl_bindings_autogen_mock.h View 4 chunks +45 lines, -0 lines 0 comments Download
M ui/gl/gl_bindings_autogen_mock.cc View 5 chunks +81 lines, -0 lines 0 comments Download
M ui/gl/gl_enums_implementation_autogen.h View 2 chunks +3 lines, -3 lines 0 comments Download
M ui/gl/gl_mock.h View 1 1 chunk +15 lines, -0 lines 0 comments Download
M ui/gl/gl_mock_autogen_gl.h View 3 chunks +34 lines, -0 lines 0 comments Download
M ui/gl/gl_stub_autogen_gl.h View 4 chunks +41 lines, -0 lines 0 comments Download

Messages

Total messages: 19 (9 generated)
Corentin Wallez
PTAL, this fixes a todo from a previous patch and will be ready to CQ ...
3 years, 8 months ago (2017-04-19 17:33:44 UTC) #3
Geoff Lang
lgtm (non-owner)
3 years, 8 months ago (2017-04-19 17:52:28 UTC) #4
Geoff Lang
https://codereview.chromium.org/2826143003/diff/1/ui/gl/gl_enums_implementation_autogen.h File ui/gl/gl_enums_implementation_autogen.h (left): https://codereview.chromium.org/2826143003/diff/1/ui/gl/gl_enums_implementation_autogen.h#oldcode643 ui/gl/gl_enums_implementation_autogen.h:643: 0x78F2, "GL_READ_WRITE_CHROMIUM", On 2017/04/19 17:33:43, Corentin Wallez wrote: > ...
3 years, 8 months ago (2017-04-19 17:53:02 UTC) #5
Zhenyao Mo
lgtm but I am not ui/gl owner +kbr
3 years, 8 months ago (2017-04-19 17:53:41 UTC) #7
Corentin Wallez
Thanks Mo, I hadn't realized, sorry about that.
3 years, 8 months ago (2017-04-19 17:55:19 UTC) #8
Ken Russell (switch to Gerrit)
lgtm
3 years, 8 months ago (2017-04-19 18:20:35 UTC) #9
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.org/2826143003/1
3 years, 8 months ago (2017-04-19 20:00:17 UTC) #11
commit-bot: I haz the power
Try jobs failed on following builders: mac_chromium_rel_ng on master.tryserver.chromium.mac (JOB_FAILED, http://build.chromium.org/p/tryserver.chromium.mac/builders/mac_chromium_rel_ng/builds/434220)
3 years, 8 months ago (2017-04-19 20:15:07 UTC) #13
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.org/2826143003/20001
3 years, 8 months ago (2017-04-20 15:19:44 UTC) #16
commit-bot: I haz the power
3 years, 8 months ago (2017-04-20 17:19:40 UTC) #19
Message was sent while issue was closed.
Committed patchset #2 (id:20001) as
https://chromium.googlesource.com/chromium/src/+/7cc769d230580677418d35623a89...

Powered by Google App Engine
This is Rietveld 408576698