Harden uniform array index parsing.

src/common/utilities.cpp

@@ -773,7 +773,6 @@ std::string ParseResourceName(const std::string &name, std::vector<unsigned int>
 unsigned int ParseArrayIndex(const std::string &name, size_t *nameLengthWithoutArrayIndexOut)
 {
     ASSERT(nameLengthWithoutArrayIndexOut != nullptr);
-    unsigned int subscript = GL_INVALID_INDEX;
 
     // Strip any trailing array operator and retrieve the subscript
     size_t open = name.find_last_of('[');
@@ -790,14 +789,22 @@ unsigned int ParseArrayIndex(const std::string &name, size_t *nameLengthWithoutA
         }
         if (indexIsValidDecimalNumber)
         {
-            subscript                       = atoi(name.c_str() + open + 1);
-            *nameLengthWithoutArrayIndexOut = open;
-            return subscript;
+            errno = 0;  // reset global error flag.
+            unsigned long subscript =
+                strtoul(name.c_str() + open + 1, /*endptr*/ nullptr, /*radix*/ 10);
+
+            // Check if resulting integer is out-of-range or conversion error.
+            if ((subscript <= static_cast<unsigned long>(UINT_MAX)) &&
+                !(subscript == ULONG_MAX && errno == ERANGE) && !(errno != 0 && subscript == 0))
+            {
+                *nameLengthWithoutArrayIndexOut = open;
+                return static_cast<unsigned int>(subscript);
+            }
         }
     }
 
     *nameLengthWithoutArrayIndexOut = name.length();
-    return subscript;
+    return GL_INVALID_INDEX;
 }
 
 const char *GetGenericErrorMessage(GLenum error)

src/common/utilities_unittest.cpp

@@ -168,4 +168,13 @@ TEST(ParseArrayIndex, ArrayIndexBogus)
     EXPECT_EQ(11u, nameLengthWithoutArrayIndex);
 }
 
+// Verify that using an index value out-of-range fails.
+TEST(ParseArrayIndex, ArrayIndexOutOfRange)
+{
+    size_t nameLengthWithoutArrayIndex;
+    EXPECT_EQ(GL_INVALID_INDEX,
+              gl::ParseArrayIndex("foo[4294967296]", &nameLengthWithoutArrayIndex));
+    EXPECT_EQ(15u, nameLengthWithoutArrayIndex);
+}
+
 }  // anonymous namespace