commit ece7c5a848df6b64e361184bbf3a9739b209e40c
author Corentin Wallez <cwallez@chromium.org> Wed Sep 21 15:28:23 2016 -0400
committer Commit Bot <commit-bot@chromium.org> Tue Sep 27 15:58:00 2016 +0000
tree 7cbe5217698549d7d20517a0e29bdf4f7b59da7b
parent 2cacb7783116bdd94b2dd70315418a62e035bd1d

Add validation for the pack buffer in ReadPixels

BUG=angleproject:1512

Change-Id: Ia6bac628c35f04bc5d3adfde1569902475519698
Reviewed-on: https://chromium-review.googlesource.com/387668
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Geoff Lang <geofflang@chromium.org>
Reviewed-by: Jamie Madill <jmadill@chromium.org>

src/libANGLE/validationES3.cpp

diff --git a/src/libANGLE/validationES3.cpp b/src/libANGLE/validationES3.cpp
index c891563..782646f 100644
--- a/src/libANGLE/validationES3.cpp
+++ b/src/libANGLE/validationES3.cpp
@@ -477,7 +477,7 @@
 
     // Check for pixel unpack buffer related API errors
     gl::Buffer *pixelUnpackBuffer = context->getGLState().getTargetBuffer(GL_PIXEL_UNPACK_BUFFER);
-    if (pixelUnpackBuffer != NULL)
+    if (pixelUnpackBuffer != nullptr)
     {
         // ...the data would be unpacked from the buffer object such that the memory reads required
         // would exceed the data store size.
@@ -513,7 +513,8 @@
 
             if ((checkedOffset.ValueOrDie() % dataBytesPerPixel) != 0)
             {
-                context->handleError(Error(GL_INVALID_OPERATION));
+                context->handleError(
+                    Error(GL_INVALID_OPERATION, "Reads would overflow the pixel unpack buffer."));
                 return false;
             }
         }
@@ -521,7 +522,7 @@
         // ...the buffer object's data store is currently mapped.
         if (pixelUnpackBuffer->isMapped())
         {
-            context->handleError(Error(GL_INVALID_OPERATION));
+            context->handleError(Error(GL_INVALID_OPERATION, "Pixel unpack buffer is mapped."));
             return false;
         }
     }