Skip to content

A
angle
Commit 41a2b8ea by Geoff Lang
Options

Revert "Protect against overflow in BinaryInputStream."

This reverts commit dfa2fe31. Change-Id: If4a7eb1876876991c537d0a9077cede52ba40b95 Reviewed-on: https://chromium-review.googlesource.com/316621Reviewed-by: 's avatarGeoff Lang <geofflang@chromium.org> Tested-by: 's avatarGeoff Lang <geofflang@chromium.org>
parent a5ed56ee
Showing with 3 additions and 81 deletions
src/libANGLE/BinaryStream.h
......@@ -92,7 +92,7 @@ class BinaryInputStream : angle::NonCopyable
return;
}
if (!rx::IsUnsignedAdditionSafe(mOffset, length) || mOffset + length > mLength)
if (mOffset + length > mLength)
{
mError = true;
return;
......@@ -104,7 +104,7 @@ class BinaryInputStream : angle::NonCopyable
void skip(size_t length)
{
if (!rx::IsUnsignedAdditionSafe(mOffset, length) || mOffset + length > mLength)
if (mOffset + length > mLength)
{
mError = true;
return;
......@@ -144,15 +144,9 @@ class BinaryInputStream : angle::NonCopyable
{
StaticAssertIsFundamental<T>();
if (!rx::IsUnsignedMultiplicationSafe(num, sizeof(T)))
{
mError = true;
return;
}
size_t length = num * sizeof(T);
if (!rx::IsUnsignedAdditionSafe(mOffset, length) || mOffset + length > mLength)
if (mOffset + length > mLength)
{
mError = true;
return;
......
src/libANGLE/BinaryStream_unittest.cpp deleted 100644 → 0
//
// Copyright (c) 2015 The ANGLE Project Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// BinaryStream_unittest.cpp: Unit tests of the binary stream classes.
#include <gtest/gtest.h>
#include "libANGLE/BinaryStream.h"
namespace angle
{
// Test that errors are properly generated for overflows.
TEST(BinaryInputStream, Overflow)
{
const uint8_t goodValue = 2;
const uint8_t badValue = 255;
const size_t dataSize = 1024;
const size_t slopSize = 1024;
std::vector<uint8_t> data(dataSize + slopSize);
std::fill(data.begin(), data.begin() + dataSize, goodValue);
std::fill(data.begin() + dataSize, data.end(), badValue);
std::vector<uint8_t> outputData(dataSize);
auto checkDataIsSafe = [](uint8_t item)
{
return item == goodValue;
};
{
// One large read
gl::BinaryInputStream stream(data.data(), dataSize);
stream.readBytes(outputData.data(), dataSize);
ASSERT_FALSE(stream.error());
ASSERT_TRUE(std::all_of(outputData.begin(), outputData.end(), checkDataIsSafe));
ASSERT_TRUE(stream.endOfStream());
}
{
// Two half-sized reads
gl::BinaryInputStream stream(data.data(), dataSize);
stream.readBytes(outputData.data(), dataSize / 2);
ASSERT_FALSE(stream.error());
stream.readBytes(outputData.data() + dataSize / 2, dataSize / 2);
ASSERT_FALSE(stream.error());
ASSERT_TRUE(std::all_of(outputData.begin(), outputData.end(), checkDataIsSafe));
ASSERT_TRUE(stream.endOfStream());
}
{
// One large read that is too big
gl::BinaryInputStream stream(data.data(), dataSize);
stream.readBytes(outputData.data(), dataSize + 1);
ASSERT_TRUE(stream.error());
}
{
// Two reads, one that overflows the offset
gl::BinaryInputStream stream(data.data(), dataSize);
stream.readBytes(outputData.data(), dataSize - 1);
ASSERT_FALSE(stream.error());
stream.readBytes(outputData.data(), std::numeric_limits<size_t>::max() - dataSize - 2);
}
}
}
src/tests/angle_unittests.gypi
......@@ -20,7 +20,6 @@
'<(angle_path)/src/common/matrix_utils_unittest.cpp',
'<(angle_path)/src/common/string_utils_unittest.cpp',
'<(angle_path)/src/common/utilities_unittest.cpp',
'<(angle_path)/src/libANGLE/BinaryStream_unittest.cpp',
'<(angle_path)/src/libANGLE/Config_unittest.cpp',
'<(angle_path)/src/libANGLE/Fence_unittest.cpp',
'<(angle_path)/src/libANGLE/HandleAllocator_unittest.cpp',
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment