commit 0d0fb43f34eeea20bf78089ca2a4e1f2831cffe5
author Jamie Madill <jmadill@chromium.org> Fri Sep 07 17:43:32 2018 -0400
committer Commit Bot <commit-bot@chromium.org> Tue Sep 11 01:43:38 2018 +0000
tree 5260fe1ff4668d1d74df18c46c28173797e6fe15
parent 63aa0e5b7001affb6a564049cf5b09e21083e332

Pass unpack buffer as explicit parameter to texSubImage.

This allows us to override it in the incomplete texture init. Any
back-end that used incomplete textures was vulnerable to a bug where
the unpack buffer would be used to initialize the incomplete texture.

Bug: chromium:880906
Change-Id: Ica558e4a4d81de9212f0bc6619ccd812a048ad45
Reviewed-on: https://chromium-review.googlesource.com/1214207
Reviewed-by: Yuly Novikov <ynovikov@chromium.org>
Reviewed-by: Frank Henigman <fjhenigman@chromium.org>
Commit-Queue: Jamie Madill <jmadill@chromium.org>

src/libANGLE/renderer/renderer_utils.cpp

diff --git a/src/libANGLE/renderer/renderer_utils.cpp b/src/libANGLE/renderer/renderer_utils.cpp
index 6230556..b677333 100644
--- a/src/libANGLE/renderer/renderer_utils.cpp
+++ b/src/libANGLE/renderer/renderer_utils.cpp
@@ -446,8 +446,8 @@
     {
         for (gl::TextureTarget face : gl::AllCubeFaceTextureTargets())
         {
-            ANGLE_TRY(
-                t->setSubImage(context, unpack, face, 0, area, GL_RGBA, GL_UNSIGNED_BYTE, color));
+            ANGLE_TRY(t->setSubImage(context, unpack, nullptr, face, 0, area, GL_RGBA,
+                                     GL_UNSIGNED_BYTE, color));
         }
     }
     else if (type == gl::TextureType::_2DMultisample)
@@ -457,8 +457,9 @@
     }
     else
     {
-        ANGLE_TRY(t->setSubImage(context, unpack, gl::NonCubeTextureTypeToTarget(createType), 0,
-                                 area, GL_RGBA, GL_UNSIGNED_BYTE, color));
+        ANGLE_TRY(t->setSubImage(context, unpack, nullptr,
+                                 gl::NonCubeTextureTypeToTarget(createType), 0, area, GL_RGBA,
+                                 GL_UNSIGNED_BYTE, color));
     }
 
     ANGLE_TRY(t->syncState(context));