commit 44ff5a76d42b2ede0b4f08bf6673d7141855275a
author Geoff Lang <geofflang@chromium.org> Fri Feb 03 15:15:43 2017 -0500
committer Commit Bot <commit-bot@chromium.org> Mon Feb 06 21:07:07 2017 +0000
tree 8243fb883e969d0371080dc572d24e5c58f0e096
parent c295e51609b7a31e4abc3f5259c24317b336efff

Validate xoffset and yoffset are multiples of blocksize.

Affects glCompressedTexSubImage and glCopyCompressedTexSubImage calls.

BUG=668223

Change-Id: Ie71faa1fa7dac12cec51a2e29e0ce212ac54e411
Reviewed-on: https://chromium-review.googlesource.com/437605
Commit-Queue: Geoff Lang <geofflang@chromium.org>
Reviewed-by: Jamie Madill <jmadill@chromium.org>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>

src/libANGLE/validationES.cpp

diff --git a/src/libANGLE/validationES.cpp b/src/libANGLE/validationES.cpp
index 2297f6f..78073e4 100644
--- a/src/libANGLE/validationES.cpp
+++ b/src/libANGLE/validationES.cpp
@@ -1718,6 +1718,8 @@
 
 bool ValidCompressedImageSize(const ValidationContext *context,
                               GLenum internalFormat,
+                              GLint xoffset,
+                              GLint yoffset,
                               GLsizei width,
                               GLsizei height)
 {
@@ -1727,14 +1729,16 @@
         return false;
     }
 
-    if (width < 0 || height < 0)
+    if (xoffset < 0 || yoffset < 0 || width < 0 || height < 0)
     {
         return false;
     }
 
     if (CompressedTextureFormatRequiresExactSize(internalFormat))
     {
-        if ((static_cast<GLuint>(width) > formatInfo.compressedBlockWidth &&
+        if (xoffset % formatInfo.compressedBlockWidth != 0 ||
+            yoffset % formatInfo.compressedBlockHeight != 0 ||
+            (static_cast<GLuint>(width) > formatInfo.compressedBlockWidth &&
              width % formatInfo.compressedBlockWidth != 0) ||
             (static_cast<GLuint>(height) > formatInfo.compressedBlockHeight &&
              height % formatInfo.compressedBlockHeight != 0))
@@ -3143,7 +3147,8 @@
         return false;
     }
 
-    if (formatInfo.compressed && !ValidCompressedImageSize(context, internalformat, width, height))
+    if (formatInfo.compressed &&
+        !ValidCompressedImageSize(context, internalformat, xoffset, yoffset, width, height))
     {
         context->handleError(Error(GL_INVALID_OPERATION));
         return false;