Protect against integer overflows in the IndexBuffer class by validating that…

Protect against integer overflows in the IndexBuffer class by validating that the new write position will not overflow. Issue 444 Signed-off-by: Jamie Madil Signed-off-by: Shannon Woods Author: Geoff Lang

Protect against integer overflows in the IndexBuffer class by validating that…
6322ef47 · Geoff Lang · Shannon Woods · 0c8b4e56 · 6322ef47
Commit 6322ef47 authored Jul 09, 2013 by Geoff Lang Committed by Shannon Woods Jul 11, 2013
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 1 deletion

IndexBuffer.cpp src/libGLESv2/renderer/IndexBuffer.cpp +2 -1

No files found.
--- a/src/libGLESv2/renderer/IndexBuffer.cpp
+++ b/src/libGLESv2/renderer/IndexBuffer.cpp
@@ -130,12 +130,13 @@ bool StreamingIndexBufferInterface::reserveBufferSpace(unsigned int size, GLenum
 {
    bool result = true;
    unsigned int curBufferSize = getBufferSize();
+    unsigned int writePos = getWritePosition();
    if (size > curBufferSize)
    {
        result = setBufferSize(std::max(size, 2 * curBufferSize), indexType);
        setWritePosition(0);
    }
-    else if (getWritePosition() + size > curBufferSize)
+    else if (writePos + size > curBufferSize || writePos + size < writePos)
    {
        if (!discard())
        {