Skip to content

A
angle
Commit 29eeb610 by Shahbaz Youssefi Committed by Commit Bot
Options

Vulkan: Fix validation of MSRTT framebuffer attachment

The attachment was being accessed before being validated. A fuzzer test was giving this function texture ID -1. Bug: chromium:1146753 Change-Id: Ic48f5fd2eed4252e90be5d63fd698b38bd3ef85f Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/2623814Reviewed-by: 's avatarShahbaz Youssefi <syoussefi@chromium.org> Commit-Queue: Shahbaz Youssefi <syoussefi@chromium.org>
parent 50c82f42
Showing with 5 additions and 5 deletions
src/libANGLE/validationES2.cpp
...@@ -6296,6 +6296,11 @@ bool ValidateFramebufferTexture2DMultisampleEXT(const Context *context, ...@@ -6296,6 +6296,11 @@ bool ValidateFramebufferTexture2DMultisampleEXT(const Context *context,
return false; return false;
} }
if (!ValidateFramebufferTextureBase(context, target, attachment, texture, level))
{
return false;
}
// EXT_multisampled_render_to_texture returns INVALID_OPERATION when a sample number higher than // EXT_multisampled_render_to_texture returns INVALID_OPERATION when a sample number higher than
// the maximum sample number supported by this format is passed. // the maximum sample number supported by this format is passed.
// The TextureCaps::getMaxSamples method is only guarenteed to be valid when the context is ES3. // The TextureCaps::getMaxSamples method is only guarenteed to be valid when the context is ES3.
...@@ -6311,11 +6316,6 @@ bool ValidateFramebufferTexture2DMultisampleEXT(const Context *context, ...@@ -6311,11 +6316,6 @@ bool ValidateFramebufferTexture2DMultisampleEXT(const Context *context,
} }
} }
if (!ValidateFramebufferTextureBase(context, target, attachment, texture, level))
{
return false;
}
// Unless EXT_multisampled_render_to_texture2 is enabled, only color attachment 0 can be used. // Unless EXT_multisampled_render_to_texture2 is enabled, only color attachment 0 can be used.
if (!context->getExtensions().multisampledRenderToTexture2 && if (!context->getExtensions().multisampledRenderToTexture2 &&
attachment != GL_COLOR_ATTACHMENT0) attachment != GL_COLOR_ATTACHMENT0)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment