ES3: Fix crash when binding nullptr to DEPTH_STENCIL.

In some cases, binding nullptr could query for the internal format of the null object, causing us to dereference null and crash. BUG=angleproject:1080 TEST=dEQP-GLES3.functional.multisample.fbo_* Change-Id: I592ab31dc1efadfac003c39051632fc2a0fff0cc Reviewed-on: https://chromium-review.googlesource.com/286853Reviewed-by: Geoff Lang <geofflang@chromium.org> Reviewed-by: Corentin Wallez <cwallez@chromium.org> Tested-by: Jamie Madill <jmadill@chromium.org>

ES3: Fix crash when binding nullptr to DEPTH_STENCIL.
375c37c9 · Jamie Madill · 86af3d27 · 375c37c9
Commit 375c37c9 authored Jul 21, 2015 by Jamie Madill
Hide whitespace changes
Inline Side-by-side

Showing with 13 additions and 11 deletions

Framebuffer.cpp src/libANGLE/Framebuffer.cpp +13 -11

No files found.
--- a/src/libANGLE/Framebuffer.cpp
+++ b/src/libANGLE/Framebuffer.cpp
@@ -601,19 +601,21 @@ void Framebuffer::setAttachment(GLenum type,
    if (binding == GL_DEPTH_STENCIL || binding == GL_DEPTH_STENCIL_ATTACHMENT)
    {
        // ensure this is a legitimate depth+stencil format
-        FramebufferAttachment::Target target(binding, textureIndex);
+        FramebufferAttachmentObject *attachmentObj = resource;
-        GLenum internalFormat = resource->getAttachmentInternalFormat(target);
+        if (resource)
-        const InternalFormat &formatInfo = GetInternalFormatInfo(internalFormat);
-        if (resource && formatInfo.depthBits > 0 && formatInfo.stencilBits > 0)
        {
-            mData.mDepthAttachment.attach(type, binding, textureIndex, resource);
+            FramebufferAttachment::Target target(binding, textureIndex);
-            mData.mStencilAttachment.attach(type, binding, textureIndex, resource);
+            GLenum internalFormat            = resource->getAttachmentInternalFormat(target);
-        }
+            const InternalFormat &formatInfo = GetInternalFormatInfo(internalFormat);
-        else
+            if (formatInfo.depthBits == 0 || formatInfo.stencilBits == 0)
-        {
+            {
-            mData.mDepthAttachment.detach();
+                // Attaching nullptr detaches the current attachment.
-            mData.mStencilAttachment.detach();
+                attachmentObj = nullptr;
+            }
        }
+        mData.mDepthAttachment.attach(type, binding, textureIndex, attachmentObj);
+        mData.mStencilAttachment.attach(type, binding, textureIndex, attachmentObj);
        mImpl->onUpdateDepthStencilAttachment();
    }
    else