Validate target parameter in CopyTexImage calls before using to check mip level

src/libGLESv2/validationES.cpp

@@ -62,6 +62,29 @@ bool ValidTextureTarget(const Context *context, GLenum target)
     }
 }
 
+// This function differs from ValidTextureTarget in that the target must be
+// usable as the destination of a 2D operation-- so a cube face is valid, but
+// GL_TEXTURE_CUBE_MAP is not.
+bool ValidTexture2DDestinationTarget(const Context *context, GLenum target)
+{
+    switch (target)
+    {
+      case GL_TEXTURE_2D:
+      case GL_TEXTURE_CUBE_MAP_POSITIVE_X:
+      case GL_TEXTURE_CUBE_MAP_NEGATIVE_X:
+      case GL_TEXTURE_CUBE_MAP_POSITIVE_Y:
+      case GL_TEXTURE_CUBE_MAP_NEGATIVE_Y:
+      case GL_TEXTURE_CUBE_MAP_POSITIVE_Z:
+      case GL_TEXTURE_CUBE_MAP_NEGATIVE_Z:
+        return true;
+      case GL_TEXTURE_2D_ARRAY:
+      case GL_TEXTURE_3D:
+        return (context->getClientVersion() >= 3);
+      default:
+        return false;
+    }
+}
+
 bool ValidFramebufferTarget(GLenum target)
 {
     META_ASSERT(GL_DRAW_FRAMEBUFFER_ANGLE == GL_DRAW_FRAMEBUFFER && GL_READ_FRAMEBUFFER_ANGLE == GL_READ_FRAMEBUFFER);

src/libGLESv2/validationES.h

@@ -16,6 +16,7 @@ class Context;
 
 bool ValidCap(const Context *context, GLenum cap);
 bool ValidTextureTarget(const Context *context, GLenum target);
+bool ValidTexture2DDestinationTarget(const Context *context, GLenum target);
 bool ValidFramebufferTarget(GLenum target);
 bool ValidBufferTarget(const Context *context, GLenum target);
 bool ValidBufferParameter(const Context *context, GLenum pname);

src/libGLESv2/validationES2.cpp

@@ -457,6 +457,11 @@ bool ValidateES2CopyTexImageParameters(gl::Context* context, GLenum target, GLin
                                        GLint xoffset, GLint yoffset, GLint x, GLint y, GLsizei width, GLsizei height,
                                        GLint border)
 {
+    if (!ValidTexture2DDestinationTarget(context, target))
+    {
+        return gl::error(GL_INVALID_ENUM, false);
+    }
+
     if (!gl::IsInternalTextureTarget(target, context->getClientVersion()))
     {
         return gl::error(GL_INVALID_ENUM, false);

src/libGLESv2/validationES3.cpp

@@ -286,6 +286,11 @@ bool ValidateES3CopyTexImageParameters(gl::Context *context, GLenum target, GLin
                                        bool isSubImage, GLint xoffset, GLint yoffset, GLint zoffset, GLint x, GLint y,
                                        GLsizei width, GLsizei height, GLint border)
 {
+    if (!ValidTexture2DDestinationTarget(context, target))
+    {
+        return gl::error(GL_INVALID_ENUM, false);
+    }
+
     if (level < 0 || xoffset < 0 || yoffset < 0 || zoffset < 0 || width < 0 || height < 0)
     {
         return gl::error(GL_INVALID_VALUE, false);
@@ -451,6 +456,7 @@ bool ValidateES3CopyTexImageParameters(gl::Context *context, GLenum target, GLin
     }
 
 
+
     // If width or height is zero, it is a no-op.  Return false without setting an error.
     return (width > 0 && height > 0);
 }