commit 876dc7240025ef09a305ca66a9346decba715d25
author Geoff Lang <geofflang@chromium.org> Thu May 01 17:10:24 2014 -0400
committer Geoff Lang <geofflang@chromium.org> Fri May 02 17:48:25 2014 +0000
tree b461b2915a5cffe35bd74d61c9d0be0bacfc768f
parent a18299c961d0cc03c3cbd0a3b9f51dd6c80578d7

Fix 64-bit build failures.

Update the BufferStorage classes to use size_t for all sizes and offsets.
BufferStorage9 now uses a std::vector to manage its memory.

BUG=angle:631

Change-Id: Iea4e7b33ede59a5b9c6a1245690c4b7865096fc3
Reviewed-on: https://chromium-review.googlesource.com/197819
Reviewed-by: Nicolas Capens <nicolascapens@chromium.org>
Tested-by: Geoff Lang <geofflang@chromium.org>

src/libGLESv2/libGLESv2.cpp

diff --git a/src/libGLESv2/libGLESv2.cpp b/src/libGLESv2/libGLESv2.cpp
index fe8002b..8e2c42e 100644
--- a/src/libGLESv2/libGLESv2.cpp
+++ b/src/libGLESv2/libGLESv2.cpp
@@ -644,7 +644,13 @@
                 return gl::error(GL_INVALID_OPERATION);
             }
 
-            if ((size_t)size + offset > buffer->size())
+            // Check for possible overflow of size + offset
+            if (!rx::IsUnsignedAdditionSafe<size_t>(size, offset))
+            {
+                return gl::error(GL_OUT_OF_MEMORY);
+            }
+
+            if (size + offset > buffer->size())
             {
                 return gl::error(GL_INVALID_VALUE);
             }