commit 4b4cdff894f412ad54fc53e24de3edbf5b25c07c
author Jamie Madill <jmadill@chromium.org> Mon Jun 06 13:53:38 2016 -0700
committer Commit Bot <commit-bot@chromium.org> Wed Jun 08 01:17:58 2016 +0000
tree 3c8a2113b9c01c7a93e2a2886df2dfb884374cee
parent 8b8d043205a69802be7579bd90798162f34740b2

Fix unpack parameter validation.

BUG=angleproject:1397

Change-Id: Icdfc99eefcfad730ec887b82ec0758a6d6c0b9a7
Reviewed-on: https://chromium-review.googlesource.com/348064
Reviewed-by: Geoff Lang <geofflang@chromium.org>
Commit-Queue: Jamie Madill <jmadill@chromium.org>

src/libANGLE/validationES3.cpp

diff --git a/src/libANGLE/validationES3.cpp b/src/libANGLE/validationES3.cpp
index acdffca..39bd20e 100644
--- a/src/libANGLE/validationES3.cpp
+++ b/src/libANGLE/validationES3.cpp
@@ -472,25 +472,12 @@
     {
         // ...the data would be unpacked from the buffer object such that the memory reads required
         // would exceed the data store size.
-        size_t widthSize = static_cast<size_t>(width);
-        size_t heightSize = static_cast<size_t>(height);
-        size_t depthSize = static_cast<size_t>(depth);
         GLenum sizedFormat = GetSizedInternalFormat(actualInternalFormat, type);
-
-        CheckedNumeric<size_t> checkedBytes(gl::GetInternalFormatInfo(sizedFormat).pixelBytes);
-        checkedBytes *= widthSize;
-        checkedBytes *= heightSize;
-        checkedBytes *= depthSize;
-
-        if (!checkedBytes.IsValid())
-        {
-            // Overflow past the end of the buffer
-            context->handleError(Error(GL_INVALID_OPERATION, "Integer overflow"));
-            return false;
-        }
-
         const gl::InternalFormat &formatInfo = gl::GetInternalFormatInfo(sizedFormat);
-        auto copyBytesOrErr = formatInfo.computeBlockSize(type, gl::Extents(width, height, depth));
+        const gl::Extents size(width, height, depth);
+        const auto &unpack = context->getState().getUnpackState();
+
+        auto copyBytesOrErr = formatInfo.computeUnpackSize(type, size, unpack);
         if (copyBytesOrErr.isError())
         {
             context->handleError(copyBytesOrErr.getError());
@@ -1549,6 +1536,12 @@
         return false;
     }
 
+    if (!ValidTextureTarget(context, target))
+    {
+        context->handleError(Error(GL_INVALID_ENUM));
+        return false;
+    }
+
     // Validate image size
     if (!ValidImageSizeParameters(context, target, level, width, height, depth, false))
     {
@@ -1557,8 +1550,14 @@
     }
 
     const InternalFormat &formatInfo = GetInternalFormatInfo(internalformat);
+    if (!formatInfo.compressed)
+    {
+        context->handleError(Error(GL_INVALID_ENUM, "Not a valid compressed texture format"));
+        return false;
+    }
+
     auto blockSizeOrErr =
-        formatInfo.computeBlockSize(GL_UNSIGNED_BYTE, gl::Extents(width, height, depth));
+        formatInfo.computeCompressedImageSize(GL_UNSIGNED_BYTE, gl::Extents(width, height, depth));
     if (blockSizeOrErr.isError())
     {
         context->handleError(Error(GL_INVALID_VALUE));
@@ -1907,7 +1906,7 @@
 
     const InternalFormat &formatInfo = GetInternalFormatInfo(format);
     auto blockSizeOrErr =
-        formatInfo.computeBlockSize(GL_UNSIGNED_BYTE, gl::Extents(width, height, depth));
+        formatInfo.computeCompressedImageSize(GL_UNSIGNED_BYTE, gl::Extents(width, height, depth));
     if (blockSizeOrErr.isError())
     {
         context->handleError(blockSizeOrErr.getError());