Protect against integer overflows in the IndexBuffer class by validating that…

Protect against integer overflows in the IndexBuffer class by validating that the new write position will not overflow. Issue 444 Signed-off-by: Jamie Madil Signed-off-by: Shannon Woods Author: Geoff Lang

Protect against integer overflows in the IndexBuffer class by validating that…
d81cf64c · Geoff Lang · Shannon Woods · fe5b2726 · d81cf64c
Commit d81cf64c authored Jul 09, 2013 by Geoff Lang Committed by Shannon Woods Jul 19, 2013
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 1 deletion

IndexBuffer.cpp src/libGLESv2/renderer/IndexBuffer.cpp +2 -1

No files found.
--- a/src/libGLESv2/renderer/IndexBuffer.cpp
+++ b/src/libGLESv2/renderer/IndexBuffer.cpp
@@ -130,12 +130,13 @@ bool StreamingIndexBufferInterface::reserveBufferSpace(unsigned int size, GLenum
 {
    bool result = true;
    unsigned int curBufferSize = getBufferSize();
+    unsigned int writePos = getWritePosition();
    if (size > curBufferSize)
    {
        result = setBufferSize(std::max(size, 2 * curBufferSize), indexType);
        setWritePosition(0);
    }
-    else if (getWritePosition() + size > curBufferSize)
+    else if (writePos + size > curBufferSize || writePos + size < writePos)
    {
        if (!discard())
        {