D3D: Fix heap corruption when copying texture arrays

Do not use depth dimension when copying normal 2D textures of a 2d texture array. It copies past the end of the buffer obtained via ID3D11DeviceContext::Map(). Fixes a case which can be reproed with the payload disabled: gn args out\debug --args="is_debug=true" ninja -C out\debug angle_end2end_tests out\debug\angle_end2end_tests ^ --gtest_filter=Texture2DArrayCopy.SnormFormats* --gtest_catch_exceptions=0 ^ --gtest_repeat=-1 Bug: angleproject:2865 Change-Id: Id9bc5489fa41749d1b1d2e87992166b1a0af76fc Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/1641247Reviewed-by: Jamie Madill <jmadill@chromium.org> Commit-Queue: Jamie Madill <jmadill@chromium.org>

D3D: Fix heap corruption when copying texture arrays
4a757416 · Kimmo Kinnunen · Commit Bot · 12a52423 · 4a757416 · 4a757416
Commit 4a757416 authored Jun 03, 2019 by Kimmo Kinnunen Committed by Commit Bot Jun 03, 2019
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 8 deletions

TextureD3D.cpp src/libANGLE/renderer/d3d/TextureD3D.cpp +2 -2

CopyTexture3DTest.cpp src/tests/gl_tests/CopyTexture3DTest.cpp +0 -6

No files found.
--- a/src/libANGLE/renderer/d3d/TextureD3D.cpp
+++ b/src/libANGLE/renderer/d3d/TextureD3D.cpp
@@ -3288,8 +3288,8 @@ angle::Result TextureD3D_2DArray::copyTexture(const gl::Context *context,
            ANGLE_TRY(getImageAndSyncFromStorage(context, currentDestDepthIndex, &destImage));
            ANGLE_TRY(sourceD3D->getImageAndSyncFromStorage(context, currentSourceDepthIndex,
                                                            &sourceImage));
-
-            ANGLE_TRY(mRenderer->copyImage(context, destImage, sourceImage, sourceBox, destOffset,
+            gl::Box imageBox(sourceBox.x, sourceBox.y, 0, sourceBox.width, sourceBox.height, 1);
+            ANGLE_TRY(mRenderer->copyImage(context, destImage, sourceImage, imageBox, destOffset,
                                           unpackFlipY, unpackPremultiplyAlpha,
                                           unpackUnmultiplyAlpha));
        }

--- a/src/tests/gl_tests/CopyTexture3DTest.cpp
+++ b/src/tests/gl_tests/CopyTexture3DTest.cpp
@@ -1269,9 +1269,6 @@ TEST_P(Texture2DArrayCopy, SnormFormats)
 {
    ANGLE_SKIP_TEST_IF(!checkExtensions());

-    // http://anglebug.com/2865
-    ANGLE_SKIP_TEST_IF(IsWindows() && IsNVIDIA() && IsD3D11());
-
    testCopy(GL_TEXTURE_2D_ARRAY, GLColor(250, 200, 150, 190), GL_R8_SNORM, GL_BYTE, false, false,
             false, GLColor(251, 0, 0, 255));
    testCopy(GL_TEXTURE_2D_ARRAY, GLColor(250, 200, 150, 190), GL_R8_SNORM, GL_BYTE, false, true,
@@ -1417,9 +1414,6 @@ TEST_P(Texture2DArrayCopy, FloatFormats)
 {
    ANGLE_SKIP_TEST_IF(!checkExtensions());

-    // http://anglebug.com/2865
-    ANGLE_SKIP_TEST_IF(IsWindows() && IsNVIDIA() && IsD3D11());
-
    std::vector<GLenum> floatTypes = {GL_FLOAT, GL_HALF_FLOAT, GL_UNSIGNED_INT_10F_11F_11F_REV,
                                      GL_UNSIGNED_INT_5_9_9_9_REV};