Commit 7e7143d7 by Nicolas Capens

Prevent overflow in the variable packer by sanity checking each variable.

BUG=346489 Change-Id: I28f5751580729a4d4d77fa6fdee0b4a6628a05de Reviewed-on: https://chromium-review.googlesource.com/188010Reviewed-by: 's avatarJamie Madill <jmadill@chromium.org> Tested-by: 's avatarNicolas Capens <nicolascapens@chromium.org> Reviewed-by: 's avatarShannon Woods <shannonwoods@chromium.org>
parent df007eac
...@@ -197,6 +197,14 @@ bool VariablePacker::CheckVariablesWithinPackingLimits(int maxVectors, const TVa ...@@ -197,6 +197,14 @@ bool VariablePacker::CheckVariablesWithinPackingLimits(int maxVectors, const TVa
bottomNonFullRow_ = maxRows_ - 1; bottomNonFullRow_ = maxRows_ - 1;
TVariableInfoList variables(in_variables); TVariableInfoList variables(in_variables);
// Check whether each variable fits in the available vectors.
for (size_t i = 0; i < variables.size(); i++) {
const TVariableInfo& variable = variables[i];
if (variable.size > maxVectors / GetNumRows(variable.type)) {
return false;
}
}
// As per GLSL 1.017 Appendix A, Section 7 variables are packed in specific // As per GLSL 1.017 Appendix A, Section 7 variables are packed in specific
// order by type, then by size of array, largest first. // order by type, then by size of array, largest first.
std::sort(variables.begin(), variables.end(), TVariableInfoComparer()); std::sort(variables.begin(), variables.end(), TVariableInfoComparer());
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment