commit 18e323ab2cff6e4bab6473b70109a33fedd76c25
author Jamie Madill <jmadill@chromium.org> Fri May 11 16:54:17 2018 -0400
committer Commit Bot <commit-bot@chromium.org> Sat May 12 01:29:43 2018 +0000
tree 71197cfde375a4986ab63135ab99bcba9a145852
parent 422f2ce24c5b7f63f6dd74b13b7ca07751d0dac0

D3D11: Fix out-of-range access with robust access.

When using a vertex buffer with DYNAMIC usage, with robust buffer
access enabled, we would sometimes read out-of-bounds when using very
large values for the index range. An unchecked signed addition would
overflow and lead to reading a negative offset.

Fix this problem by keeping the value size_t whenever possible. Also do
clamped casts when converting to a smaller values.

Also adds a regression test.

Bug: chromium:842028
Change-Id: Ie630ac857c6acfc0bace849a03eebfbaa2fbe89a
Reviewed-on: https://chromium-review.googlesource.com/1055928
Commit-Queue: Jamie Madill <jmadill@chromium.org>
Reviewed-by: Geoff Lang <geofflang@chromium.org>

src/tests/perf_tests/IndexDataManagerTest.cpp

diff --git a/src/tests/perf_tests/IndexDataManagerTest.cpp b/src/tests/perf_tests/IndexDataManagerTest.cpp
index 35f6586..80e1b8f 100644
--- a/src/tests/perf_tests/IndexDataManagerTest.cpp
+++ b/src/tests/perf_tests/IndexDataManagerTest.cpp
@@ -58,7 +58,7 @@
     MOCK_CONST_METHOD4(getVertexSpaceRequired,
                        gl::ErrorOrResult<unsigned int>(const gl::VertexAttribute &,
                                                        const gl::VertexBinding &,
-                                                       GLsizei,
+                                                       size_t,
                                                        GLsizei));
 
     // Dependency injection