commit 6b120b9f9d7d8dd99821691c1e28058afba1c5c0
author Jamie Madill <jmadill@chromium.org> Tue Nov 24 13:00:07 2015 -0500
committer Jamie Madill <jmadill@chromium.org> Tue Nov 24 21:07:10 2015 +0000
tree 7fb46fdb918e831ff76d91d6dfd454a231abc937
parent ee322723868f74bedaa5ab3f9bc164948098fddb

Add checks for FBO attachment layer.

We would allow the app to attach layers that were out-of-bounds. Fix
this by checking against the underlying resource dimensions. Also
rework the code a bit to clean up the texture size query, which is
available from the ImageDesc.

BUG=angleproject:869

Change-Id: I984f1db16daea6ca650d795884d8ec2cb8f05ebb
Reviewed-on: https://chromium-review.googlesource.com/313991
Tryjob-Request: Jamie Madill <jmadill@chromium.org>
Reviewed-by: Geoff Lang <geofflang@chromium.org>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Tested-by: Jamie Madill <jmadill@chromium.org>

src/libANGLE/Framebuffer.cpp

diff --git a/src/libANGLE/Framebuffer.cpp b/src/libANGLE/Framebuffer.cpp
index afe76d6..876df59 100644
--- a/src/libANGLE/Framebuffer.cpp
+++ b/src/libANGLE/Framebuffer.cpp
@@ -360,7 +360,8 @@
     {
         if (colorAttachment.isAttached())
         {
-            if (colorAttachment.getWidth() == 0 || colorAttachment.getHeight() == 0)
+            const Extents &size = colorAttachment.getSize();
+            if (size.width == 0 || size.height == 0)
             {
                 return GL_FRAMEBUFFER_INCOMPLETE_ATTACHMENT;
             }
@@ -379,6 +380,11 @@
                 {
                     return GL_FRAMEBUFFER_INCOMPLETE_ATTACHMENT;
                 }
+
+                if (colorAttachment.layer() >= size.depth)
+                {
+                    return GL_FRAMEBUFFER_INCOMPLETE_ATTACHMENT;
+                }
             }
             else if (colorAttachment.type() == GL_RENDERBUFFER)
             {
@@ -419,7 +425,8 @@
     const FramebufferAttachment &depthAttachment = mData.mDepthAttachment;
     if (depthAttachment.isAttached())
     {
-        if (depthAttachment.getWidth() == 0 || depthAttachment.getHeight() == 0)
+        const Extents &size = depthAttachment.getSize();
+        if (size.width == 0 || size.height == 0)
         {
             return GL_FRAMEBUFFER_INCOMPLETE_ATTACHMENT;
         }
@@ -467,7 +474,8 @@
     const FramebufferAttachment &stencilAttachment = mData.mStencilAttachment;
     if (stencilAttachment.isAttached())
     {
-        if (stencilAttachment.getWidth() == 0 || stencilAttachment.getHeight() == 0)
+        const Extents &size = stencilAttachment.getSize();
+        if (size.width == 0 || size.height == 0)
         {
             return GL_FRAMEBUFFER_INCOMPLETE_ATTACHMENT;
         }