Protect against integer overflows when generating index buffers for line loop…

Protect against integer overflows when generating index buffers for line loop and triangle fan drawing. Issue 444 Signed-off-by: Jamie Madil Signed-off-by: Shannon Woods Author: Geoff Lang

Protect against integer overflows when generating index buffers for line loop…
2426d5fe · Geoff Lang · Shannon Woods · a240a2f9 · 2426d5fe
Commit 2426d5fe authored Jul 09, 2013 by Geoff Lang Committed by Shannon Woods Jul 11, 2013
Hide whitespace changes
Inline Side-by-side

Showing with 10 additions and 2 deletions

Context.cpp src/libGLESv2/Context.cpp +10 -2

No files found.
--- a/src/libGLESv2/Context.cpp
+++ b/src/libGLESv2/Context.cpp
@@ -3253,7 +3253,11 @@ void Context::drawLineLoop(GLsizei count, GLenum type, const GLvoid *indices, in

    if (supports32bitIndices())
    {
-        const int spaceNeeded = (count + 1) * sizeof(unsigned int);
+        if (static_cast<unsigned int>(count + 1) > (std::numeric_limits<unsigned int>::max() / sizeof(unsigned int)))
+        {
+            return error(GL_OUT_OF_MEMORY);
+        }
+        const unsigned int spaceNeeded = (count + 1) * sizeof(unsigned int);

        if (!mLineLoopIB)
        {
@@ -3310,7 +3314,11 @@ void Context::drawLineLoop(GLsizei count, GLenum type, const GLvoid *indices, in
    }
    else
    {
-        const int spaceNeeded = (count + 1) * sizeof(unsigned short);
+        if (static_cast<unsigned short>(count + 1) > (std::numeric_limits<unsigned short>::max() / sizeof(unsigned short)))
+        {
+            return error(GL_OUT_OF_MEMORY);
+        }
+        const unsigned int spaceNeeded = (count + 1) * sizeof(unsigned short);

        if (!mLineLoopIB)
        {