Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore: cherry-pick e60cc80ff744 from chromium #30228

Merged
merged 4 commits into from Jul 29, 2021
Merged

chore: cherry-pick e60cc80ff744 from chromium #30228

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a1b7e56
chore: cherry-pick e60cc80ff744 from chromium
ppontes Jul 21, 2021
6281f77
chore: update patches
patchup[bot] Jul 21, 2021
c9b095e
Merge branch '11-x-y' into cherry-pick/11-x-y/chromium/e60cc80ff744
electron-bot Jul 22, 2021
9adca63
Merge branch '11-x-y' into cherry-pick/11-x-y/chromium/e60cc80ff744
electron-bot Jul 27, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
1 change: 1 addition & 0 deletions patches/chromium/.patches
View file
Open in desktop
Expand Up @@ -175,6 +175,7 @@ cherry-pick-b77b38a3380c.patch
cherry-pick-d9556a80a790.patch
cherry-pick-910e9e40d376.patch
cherry-pick-ff0d013f60fa.patch
cherry-pick-e60cc80ff744.patch
fix_use-after-free_with_xslt_strip-space.patch
cherry-pick-3feda0244490.patch
cherry-pick-cd98d7c0dae9.patch
35 changes: 35 additions & 0 deletions patches/chromium/cherry-pick-e60cc80ff744.patch
View file
Open in desktop
@@ -0,0 +1,35 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Shrek Shao <shrekshao@google.com>
Date: Tue, 29 Jun 2021 01:17:03 +0000
Subject: Fix multidraw validation drawcount + offset out of bounds

(cherry picked from commit 7d0a12ce19fed024d56b95a692d888fe3ef14e2f)

Bug: 1219886
Change-Id: I8a84664150758370d9a77ee22ac5549bead0e37e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2977850
Reviewed-by: Kenneth Russell <kbr@chromium.org>
Commit-Queue: Kenneth Russell <kbr@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#895423}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2988885
Reviewed-by: Shrek Shao <shrekshao@google.com>
Reviewed-by: Austin Eng <enga@chromium.org>
Cr-Commit-Position: refs/branch-heads/4515@{#1101}
Cr-Branched-From: 488fc70865ddaa05324ac00a54a6eb783b4bc41c-refs/heads/master@{#885287}

diff --git a/third_party/blink/renderer/modules/webgl/webgl_multi_draw_common.cc b/third_party/blink/renderer/modules/webgl/webgl_multi_draw_common.cc
index 6720d46394ae0346331e133f0fa8d24e5dd1e95b..bae874bbf23cdb497b92bda7bb87429dafe7d5d4 100644
--- a/third_party/blink/renderer/modules/webgl/webgl_multi_draw_common.cc
+++ b/third_party/blink/renderer/modules/webgl/webgl_multi_draw_common.cc
@@ -34,6 +34,11 @@ bool WebGLMultiDrawCommon::ValidateArray(WebGLExtensionScopedContext* scoped,
outOfBoundsDescription);
return false;
}
+ if (static_cast<uint64_t>(drawcount) + offset > size) {
+ scoped->Context()->SynthesizeGLError(GL_INVALID_OPERATION, function_name,
+ "drawcount plus offset out of bounds");
+ return false;
+ }
return true;
}