Protect against integer overflows in the IndexBuffer class by validating that…

Protect against integer overflows in the IndexBuffer class by validating that the new write position will not overflow. Issue 444 Signed-off-by: Jamie Madil Signed-off-by: Shannon Woods Author: Geoff Lang

Protect against integer overflows in the IndexBuffer class by validating that…
b7797e7e · Geoff Lang · Al Patrick · 26b4b730 · b7797e7e
Commit b7797e7e authored Jul 09, 2013 by Geoff Lang Committed by Al Patrick Jul 26, 2013
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 1 deletion

IndexBuffer.cpp src/libGLESv2/renderer/IndexBuffer.cpp +2 -1

No files found.
--- a/src/libGLESv2/renderer/IndexBuffer.cpp
+++ b/src/libGLESv2/renderer/IndexBuffer.cpp
@@ -130,12 +130,13 @@ bool StreamingIndexBufferInterface::reserveBufferSpace(unsigned int size, GLenum
 {
    bool result = true;
    unsigned int curBufferSize = getBufferSize();
+    unsigned int writePos = getWritePosition();
    if (size > curBufferSize)
    {
        result = setBufferSize(std::max(size, 2 * curBufferSize), indexType);
        setWritePosition(0);
    }
-    else if (getWritePosition() + size > curBufferSize)
+    else if (writePos + size > curBufferSize || writePos + size < writePos)
    {
        if (!discard())
        {