commit 18a2fb3a4a0ba4dc919801cfa75cf558ab6ab0bc
author Corentin Wallez <cwallez@chromium.org> Mon Aug 10 12:58:14 2015 -0700
committer Corentin Wallez <cwallez@chromium.org> Wed Aug 12 19:07:52 2015 +0000
tree dde0cfbee619ed004cc9cdc0a4bb3541f49f4eb4
parent b195643c16d3bbcdc92f54bfc41faf8c8fafad5e

ValidateDrawElements: check count > 0 then compute the index range

Otherwise glDrawElements(GL_TRIANGLES, -1, nullptr) would crash. This was
found by an ASSERT in ComputeIndexRange triggered by
dEQP-GLES2.functional.negative_api.vertex_array.draw_elements

BUG=

Change-Id: I5269031fa35aa6403c844561e04158361ee7950f
Reviewed-on: https://chromium-review.googlesource.com/292710
Tested-by: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Jamie Madill <jmadill@chromium.org>

src/libANGLE/validationES.cpp

diff --git a/src/libANGLE/validationES.cpp b/src/libANGLE/validationES.cpp
index 60d1a9f..a7804cf 100644
--- a/src/libANGLE/validationES.cpp
+++ b/src/libANGLE/validationES.cpp
@@ -1406,7 +1406,7 @@
     return true;
 }
 
-static bool ValidateDrawBase(Context *context, GLenum mode, GLsizei count, GLsizei maxVertex, GLsizei primcount)
+static bool ValidateDrawBase(Context *context, GLenum mode, GLsizei count, GLsizei primcount)
 {
     switch (mode)
     {
@@ -1471,12 +1471,6 @@
         return false;
     }
 
-    // Buffer validations
-    if (!ValidateDrawAttribs(context, primcount, maxVertex))
-    {
-        return false;
-    }
-
     // Uniform buffer validation
     for (unsigned int uniformBlockIndex = 0; uniformBlockIndex < program->getActiveUniformBlockCount(); uniformBlockIndex++)
     {
@@ -1531,7 +1525,12 @@
         return false;
     }
 
-    if (!ValidateDrawBase(context, mode, count, count, primcount))
+    if (!ValidateDrawBase(context, mode, count, primcount))
+    {
+        return false;
+    }
+
+    if (!ValidateDrawAttribs(context, primcount, count))
     {
         return false;
     }
@@ -1664,6 +1663,11 @@
         return false;
     }
 
+    if (!ValidateDrawBase(context, mode, count, primcount))
+    {
+        return false;
+    }
+
     // Use max index to validate if our vertex buffers are large enough for the pull.
     // TODO: offer fast path, with disabled index validation.
     // TODO: also disable index checking on back-ends that are robust to out-of-range accesses.
@@ -1682,7 +1686,7 @@
         *indexRangeOut = ComputeIndexRange(type, indices, count);
     }
 
-    if (!ValidateDrawBase(context, mode, count, static_cast<GLsizei>(indexRangeOut->end), primcount))
+    if (!ValidateDrawAttribs(context, primcount, static_cast<GLsizei>(indexRangeOut->end)))
     {
         return false;
     }