Commit 1d1c1152 by Nicolas Capens

Prevent overflow in the variable packer by sanity checking each variable.

BUG=346489 Change-Id: I28f5751580729a4d4d77fa6fdee0b4a6628a05de Reviewed-on: https://chromium-review.googlesource.com/188030Tested-by: 's avatarNicolas Capens <nicolascapens@chromium.org> Reviewed-by: 's avatarShannon Woods <shannonwoods@chromium.org>
parent b4d192cd
...@@ -215,6 +215,14 @@ bool VariablePacker::CheckVariablesWithinPackingLimits(int maxVectors, const TVa ...@@ -215,6 +215,14 @@ bool VariablePacker::CheckVariablesWithinPackingLimits(int maxVectors, const TVa
bottomNonFullRow_ = maxRows_ - 1; bottomNonFullRow_ = maxRows_ - 1;
TVariableInfoList variables(in_variables); TVariableInfoList variables(in_variables);
// Check whether each variable fits in the available vectors.
for (size_t i = 0; i < variables.size(); i++) {
const TVariableInfo& variable = variables[i];
if (variable.size > maxVectors / GetNumRows(variable.type)) {
return false;
}
}
// As per GLSL 1.017 Appendix A, Section 7 variables are packed in specific // As per GLSL 1.017 Appendix A, Section 7 variables are packed in specific
// order by type, then by size of array, largest first. // order by type, then by size of array, largest first.
std::sort(variables.begin(), variables.end(), TVariableInfoComparer()); std::sort(variables.begin(), variables.end(), TVariableInfoComparer());
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment