commit 416a23e855bc79ff82a81898ac475e8e40491f4b
author Geoff Lang <geofflang@chromium.org> Mon Nov 20 12:34:20 2017 -0500
committer Commit Bot <commit-bot@chromium.org> Mon Nov 20 19:38:55 2017 +0000
tree 992ffbadfc96766ad85e1a8b5d38d0d3772e7a0c
parent 4dd167fbac9eed7988407b36b1f05043d1e34d11

ProgramGL: Make sure the binary vector does not read out of bounds.

By sizing the vector to at least one element, it is not possible to pass
invalid pointers to the driver or binary stream even if the binary is
zero-sized.

BUG=angleproject:2257

Change-Id: Ie0e42bff1192207e0e069934b03dfd49e8d34824
Reviewed-on: https://chromium-review.googlesource.com/779739
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Commit-Queue: Geoff Lang <geofflang@chromium.org>

src/libANGLE/renderer/gl/ProgramGL.cpp

diff --git a/src/libANGLE/renderer/gl/ProgramGL.cpp b/src/libANGLE/renderer/gl/ProgramGL.cpp
index 34b407c..26dcae5 100644
--- a/src/libANGLE/renderer/gl/ProgramGL.cpp
+++ b/src/libANGLE/renderer/gl/ProgramGL.cpp
@@ -83,14 +83,14 @@
     GLint binaryLength = 0;
     mFunctions->getProgramiv(mProgramID, GL_PROGRAM_BINARY_LENGTH, &binaryLength);
 
-    std::vector<uint8_t> binary(binaryLength);
+    std::vector<uint8_t> binary(std::max(binaryLength, 1));
     GLenum binaryFormat = GL_NONE;
     mFunctions->getProgramBinary(mProgramID, binaryLength, &binaryLength, &binaryFormat,
-                                 &binary[0]);
+                                 binary.data());
 
     stream->writeInt(binaryFormat);
     stream->writeInt(binaryLength);
-    stream->writeBytes(&binary[0], binaryLength);
+    stream->writeBytes(binary.data(), binaryLength);
 
     reapplyUBOBindingsIfNeeded(context);
 }