Validate pixel unpack buffer offset.

src/OpenGL/libGLESv2/Context.cpp

@@ -1542,22 +1542,37 @@ GLsizei Context::getRequiredBufferSize(GLsizei width, GLsizei height, GLsizei de
 	return inputPitch * inputHeight * depth;
 }
 
-GLenum Context::getPixels(const GLvoid **data, GLenum type, GLsizei imageSize) const
+GLenum Context::getPixels(const GLvoid **pixels, GLenum type, GLsizei imageSize) const
 {
 	if(mState.pixelUnpackBuffer)
 	{
-		if(mState.pixelUnpackBuffer->name)
+		ASSERT(mState.pixelUnpackBuffer->name != 0);
+
+		if(mState.pixelUnpackBuffer->isMapped())
 		{
-			if(mState.pixelUnpackBuffer->isMapped() ||
-			   (mState.pixelUnpackBuffer->size() < static_cast<size_t>(imageSize)) ||
-			   (static_cast<GLsizei>((ptrdiff_t)(*data)) % GetTypeSize(type)))
-			{
-				return GL_INVALID_OPERATION;
-			}
+			return GL_INVALID_OPERATION;
+		}
+
+		size_t offset = static_cast<size_t>((ptrdiff_t)(*pixels));
+
+		if(offset % GetTypeSize(type) != 0)
+		{
+			return GL_INVALID_OPERATION;
 		}
 
-		*data = static_cast<const unsigned char*>(mState.pixelUnpackBuffer->data()) + (ptrdiff_t)(*data);
+		if(offset > mState.pixelUnpackBuffer->size())
+		{
+			return GL_INVALID_OPERATION;
+		}
+
+		if(mState.pixelUnpackBuffer->size() - offset < static_cast<size_t>(imageSize))
+		{
+			return GL_INVALID_OPERATION;
+		}
+
+		*pixels = static_cast<const unsigned char*>(mState.pixelUnpackBuffer->data()) + offset;
 	}
+
 	return GL_NO_ERROR;
 }
 

src/OpenGL/libGLESv2/utilities.cpp

@@ -1121,7 +1121,7 @@ namespace es2
 		return GL_NO_ERROR;
 	}
 
-	GLsizei GetTypeSize(GLenum type)
+	size_t GetTypeSize(GLenum type)
 	{
 		switch(type)
 		{

src/OpenGL/libGLESv2/utilities.h

@@ -58,7 +58,7 @@ namespace es2
 	int CubeFaceIndex(GLenum cubeTarget);
 	bool IsTextureTarget(GLenum target);
 	GLenum ValidateTextureFormatType(GLenum format, GLenum type, GLint internalformat, GLenum target, GLint clientVersion);
-	GLsizei GetTypeSize(GLenum type);
+	size_t GetTypeSize(GLenum type);
 
 	bool IsColorRenderable(GLint internalformat, GLint clientVersion);
 	bool IsDepthRenderable(GLint internalformat, GLint clientVersion);