commit 989cac3467248ec868a574682b218435464bd392
author Olli Etuaho <oetuaho@nvidia.com> Wed Jun 08 16:18:49 2016 -0700
committer Commit Bot <commit-bot@chromium.org> Thu Jun 16 12:19:59 2016 +0000
tree af4196201e26c12faee05c619eee3e904e533da5
parent e29324ff2db53cb72316a1b838ad64c271e425cf

Validate that unpack skip is in bounds

Unpack skip needs to be taken into account when determining which part
of the unpack buffer is read. This is now done in the out-of-bounds
check when validating texture upload calls.

Unpack skip code is removed from D3D9 backend, since skip is not
supported in GLES2.

BUG=angleproject:1411
TEST=angle_end2end_tests

Change-Id: I0db4db0877a352613c57e2820e5b650edb5a73ab
Reviewed-on: https://chromium-review.googlesource.com/352450
Reviewed-by: Jamie Madill <jmadill@chromium.org>
Commit-Queue: Olli Etuaho <oetuaho@nvidia.com>

src/libANGLE/formatutils.cpp

diff --git a/src/libANGLE/formatutils.cpp b/src/libANGLE/formatutils.cpp
index 9c6b0f2..c9533aa 100644
--- a/src/libANGLE/formatutils.cpp
+++ b/src/libANGLE/formatutils.cpp
@@ -763,15 +763,28 @@
     return bytes.ValueOrDie();
 }
 
-GLuint InternalFormat::computeSkipPixels(GLint rowPitch,
-                                         GLint depthPitch,
-                                         GLint skipImages,
-                                         GLint skipRows,
-                                         GLint skipPixels,
-                                         bool applySkipImages) const
+gl::ErrorOrResult<GLuint> InternalFormat::computeSkipBytes(GLuint rowPitch,
+                                                           GLuint depthPitch,
+                                                           GLint skipImages,
+                                                           GLint skipRows,
+                                                           GLint skipPixels,
+                                                           bool applySkipImages) const
 {
-    GLuint skipImagesBytes = applySkipImages ? skipImages * depthPitch : 0;
-    return skipImagesBytes + skipRows * rowPitch + skipPixels * pixelBytes;
+    CheckedNumeric<GLuint> checkedRowPitch(rowPitch);
+    CheckedNumeric<GLuint> checkedDepthPitch(depthPitch);
+    CheckedNumeric<GLuint> checkedSkipImages(static_cast<GLuint>(skipImages));
+    CheckedNumeric<GLuint> checkedSkipRows(static_cast<GLuint>(skipRows));
+    CheckedNumeric<GLuint> checkedSkipPixels(static_cast<GLuint>(skipPixels));
+    CheckedNumeric<GLuint> checkedPixelBytes(pixelBytes);
+    auto checkedSkipImagesBytes = checkedSkipImages * checkedDepthPitch;
+    if (!applySkipImages)
+    {
+        checkedSkipImagesBytes = 0;
+    }
+    auto skipBytes = checkedSkipImagesBytes + checkedSkipRows * checkedRowPitch +
+                     checkedSkipPixels * checkedPixelBytes;
+    ANGLE_TRY_CHECKED_MATH(skipBytes);
+    return skipBytes.ValueOrDie();
 }
 
 gl::ErrorOrResult<GLuint> InternalFormat::computeUnpackSize(