Commit 825b8b61 authored by Geoff Lang's avatar Geoff Lang Committed by Commit Bot

Fix the function declaration for DoScheduleCALayerInUseQueryCHROMIUM

DoScheduleCALayerInUseQueryCHROMIUM uses a signed int for the number of
textures. The handler correctly validates the buffer size is large
enough but does not validate that n > 0 before sending it to
DoScheduleCALayerInUseQueryCHROMIUM where it is silently cast to an
unsigned value.

Bug: chromium:1135937
Change-Id: I44d04c3c1b1c09ad20c265e0fd8dd5f88a93bfeb
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2485532Reviewed-by: default avatarZhenyao Mo <zmo@chromium.org>
Commit-Queue: Geoff Lang <geofflang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#819940}
parent 36d6df46
......@@ -933,7 +933,7 @@ error::Error DoScheduleCALayerCHROMIUM(GLuint contents_texture_id,
GLenum filter,
const GLfloat* bounds_rect);
error::Error DoScheduleCALayerInUseQueryCHROMIUM(
GLuint n,
GLsizei n,
const volatile GLuint* textures);
error::Error DoScheduleDCLayerCHROMIUM(GLuint texture_0,
GLuint texture_1,
......
......@@ -4911,7 +4911,7 @@ error::Error GLES2DecoderPassthroughImpl::DoScheduleCALayerCHROMIUM(
}
error::Error GLES2DecoderPassthroughImpl::DoScheduleCALayerInUseQueryCHROMIUM(
GLuint n,
GLsizei n,
const volatile GLuint* textures) {
// Validate that count is non-negative before allocating a vector
if (n < 0) {
......@@ -4921,7 +4921,7 @@ error::Error GLES2DecoderPassthroughImpl::DoScheduleCALayerInUseQueryCHROMIUM(
std::vector<gl::GLSurface::CALayerInUseQuery> queries;
queries.reserve(n);
for (GLuint i = 0; i < n; ++i) {
for (GLsizei i = 0; i < n; ++i) {
gl::GLImage* image = nullptr;
GLuint texture_id = textures[i];
if (texture_id) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment