Prevent overflow in the variable packer by sanity checking each variable.
BUG=346489
Change-Id: I28f5751580729a4d4d77fa6fdee0b4a6628a05de
Reviewed-on: https://chromium-review.googlesource.com/188030
Tested-by: Nicolas Capens <nicolascapens@chromium.org>
Reviewed-by: Shannon Woods <shannonwoods@chromium.org>
diff --git a/src/compiler/translator/VariablePacker.cpp b/src/compiler/translator/VariablePacker.cpp
index ec57bc4..6390e30 100644
--- a/src/compiler/translator/VariablePacker.cpp
+++ b/src/compiler/translator/VariablePacker.cpp
@@ -215,6 +215,14 @@
bottomNonFullRow_ = maxRows_ - 1;
TVariableInfoList variables(in_variables);
+ // Check whether each variable fits in the available vectors.
+ for (size_t i = 0; i < variables.size(); i++) {
+ const TVariableInfo& variable = variables[i];
+ if (variable.size > maxVectors / GetNumRows(variable.type)) {
+ return false;
+ }
+ }
+
// As per GLSL 1.017 Appendix A, Section 7 variables are packed in specific
// order by type, then by size of array, largest first.
std::sort(variables.begin(), variables.end(), TVariableInfoComparer());