Split the overflow check into explicit multiplication and addition overflow checks.
TRAC #23671
Signed-off-by: Nicolas Capens
Signed-off-by: Shannon Woods
Author: Geoff Lang
diff --git a/src/libGLESv2/renderer/IndexDataManager.cpp b/src/libGLESv2/renderer/IndexDataManager.cpp
index 3fe05cb..b8c7fa9 100644
--- a/src/libGLESv2/renderer/IndexDataManager.cpp
+++ b/src/libGLESv2/renderer/IndexDataManager.cpp
@@ -140,9 +140,9 @@
unsigned int typeSize = gl::GetTypeBytes(type);
- // check for interger overflows and underflows
- if (static_cast<unsigned int>(offset) > (std::numeric_limits<unsigned int>::max() / typeSize) ||
- static_cast<unsigned int>(count) > ((std::numeric_limits<unsigned int>::max() / typeSize) - offset))
+ // check for integer overflows
+ if (static_cast<unsigned int>(count) > (std::numeric_limits<unsigned int>::max() / typeSize) ||
+ typeSize * static_cast<unsigned int>(count) + offset < offset)
{
return GL_OUT_OF_MEMORY;
}