Fix overflow issue when generateMipmap for srgb texture

gpu/command_buffer/service/gles2_cmd_srgb_converter.cc

Index: gpu/command_buffer/service/gles2_cmd_srgb_converter.cc
diff --git a/gpu/command_buffer/service/gles2_cmd_srgb_converter.cc b/gpu/command_buffer/service/gles2_cmd_srgb_converter.cc
index 5556e9d20739c510b6c51434eff68252f51d2ac1..db36292e407d5db0433618e72045f27443ed6fe1 100644
--- a/gpu/command_buffer/service/gles2_cmd_srgb_converter.cc
+++ b/gpu/command_buffer/service/gles2_cmd_srgb_converter.cc
@@ -423,9 +423,10 @@ void SRGBConverter::GenerateMipmap(const gles2::GLES2Decoder* decoder,
     mipmap_levels =
         TextureManager::ComputeMipMapCount(target, width, height, depth);
   }
-  const GLint max_mipmap_available_levels =
-      (base_level + mipmap_levels) > max_level ? max_level
-                                               : (base_level + mipmap_levels);
+  const GLint max_mipmap_available_level =
+      (base_level + mipmap_levels - 1) > max_level

[Zhenyao Mo, 2017/05/08 17:25:29]

As I mentioned in the other CL, we need to use base::CheckedNumeric for this.
base_level can be set by client to any value, so there is an overflow danger
here.

[yizhou.jiang, 2017/05/09 15:13:57]

I see,base_level + mipmap_level might overflow here.

+          ? max_level
+          : (base_level + mipmap_levels - 1);
 
   glBindTexture(GL_TEXTURE_2D, srgb_converter_textures_[1]);
   if (feature_info_->ext_color_buffer_float_available() &&
@@ -473,7 +474,7 @@ void SRGBConverter::GenerateMipmap(const gles2::GLES2Decoder* decoder,
 
   // TODO(yizhou): An optimization. Attach 1 level at a time, once for every
   // iteration of the loop.
-  for (GLint level = base_level + 1; level < max_mipmap_available_levels;
+  for (GLint level = base_level + 1; level <= max_mipmap_available_level;
        ++level) {
     // copy mipmaps level by level from srgb_converter_textures_[1] to tex
     // generate mipmap for tex manually