Protect against overflow in BinaryInputStream.

src/libANGLE/BinaryStream.h

@@ -92,7 +92,7 @@ class BinaryInputStream : angle::NonCopyable
             return;
         }
 
-        if (mOffset + length > mLength)
+        if (!rx::IsUnsignedAdditionSafe(mOffset, length) || mOffset + length > mLength)
         {
             mError = true;
             return;
@@ -104,7 +104,7 @@ class BinaryInputStream : angle::NonCopyable
 
     void skip(size_t length)
     {
-        if (mOffset + length > mLength)
+        if (!rx::IsUnsignedAdditionSafe(mOffset, length) || mOffset + length > mLength)
         {
             mError = true;
             return;
@@ -144,9 +144,15 @@ class BinaryInputStream : angle::NonCopyable
     {
         StaticAssertIsFundamental<T>();
 
+        if (!rx::IsUnsignedMultiplicationSafe(num, sizeof(T)))
+        {
+            mError = true;
+            return;
+        }
+
         size_t length = num * sizeof(T);
 
-        if (mOffset + length > mLength)
+        if (!rx::IsUnsignedAdditionSafe(mOffset, length) || mOffset + length > mLength)
         {
             mError = true;
             return;

src/libANGLE/BinaryStream_unittest.cpp

+//
+// Copyright (c) 2015 The ANGLE Project Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+
+// BinaryStream_unittest.cpp: Unit tests of the binary stream classes.
+
+#include <gtest/gtest.h>
+
+#include "libANGLE/BinaryStream.h"
+
+namespace angle
+{
+
+// Test that errors are properly generated for overflows.
+TEST(BinaryInputStream, Overflow)
+{
+    const uint8_t goodValue = 2;
+    const uint8_t badValue = 255;
+
+    const size_t dataSize = 1024;
+    const size_t slopSize = 1024;
+
+    std::vector<uint8_t> data(dataSize + slopSize);
+    std::fill(data.begin(), data.begin() + dataSize, goodValue);
+    std::fill(data.begin() + dataSize, data.end(), badValue);
+
+    std::vector<uint8_t> outputData(dataSize);
+
+    auto checkDataIsSafe = [=](uint8_t item)
+    {
+        return item == goodValue;
+    };
+
+    {
+        // One large read
+        gl::BinaryInputStream stream(data.data(), dataSize);
+        stream.readBytes(outputData.data(), dataSize);
+        ASSERT_FALSE(stream.error());
+        ASSERT_TRUE(std::all_of(outputData.begin(), outputData.end(), checkDataIsSafe));
+        ASSERT_TRUE(stream.endOfStream());
+    }
+
+    {
+        // Two half-sized reads
+        gl::BinaryInputStream stream(data.data(), dataSize);
+        stream.readBytes(outputData.data(), dataSize / 2);
+        ASSERT_FALSE(stream.error());
+        stream.readBytes(outputData.data() + dataSize / 2, dataSize / 2);
+        ASSERT_FALSE(stream.error());
+        ASSERT_TRUE(std::all_of(outputData.begin(), outputData.end(), checkDataIsSafe));
+        ASSERT_TRUE(stream.endOfStream());
+    }
+
+    {
+        // One large read that is too big
+        gl::BinaryInputStream stream(data.data(), dataSize);
+        stream.readBytes(outputData.data(), dataSize + 1);
+        ASSERT_TRUE(stream.error());
+    }
+
+    {
+        // Two reads, one that overflows the offset
+        gl::BinaryInputStream stream(data.data(), dataSize);
+        stream.readBytes(outputData.data(), dataSize - 1);
+        ASSERT_FALSE(stream.error());
+        stream.readBytes(outputData.data(), std::numeric_limits<size_t>::max() - dataSize - 2);
+    }
+}
+}

src/tests/angle_unittests.gypi

@@ -20,6 +20,7 @@
             '<(angle_path)/src/common/matrix_utils_unittest.cpp',
             '<(angle_path)/src/common/string_utils_unittest.cpp',
             '<(angle_path)/src/common/utilities_unittest.cpp',
+            '<(angle_path)/src/libANGLE/BinaryStream_unittest.cpp',
             '<(angle_path)/src/libANGLE/Config_unittest.cpp',
             '<(angle_path)/src/libANGLE/Fence_unittest.cpp',
             '<(angle_path)/src/libANGLE/HandleAllocator_unittest.cpp',