Validate target in MapBufferRange/UnmapBuffer

BUG=None
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_optional_gpu_tests_rel;tryserver.chromium.mac:mac_optional_gpu_tests_rel;tryserver.chromium.win:win_optional_gpu_tests_rel

Review-Url: https://codereview.chromium.org/2028943002
Cr-Commit-Position: refs/heads/master@{#397056}

gpu/command_buffer/service/gles2_cmd_decoder.cc

@@ -15636,6 +15636,11 @@ error::Error GLES2DecoderImpl::HandleMapBufferRange(
     return error::kOutOfBounds;
   }
 
+  if (!validators_->buffer_target.IsValid(target)) {
+    LOCAL_SET_GL_ERROR_INVALID_ENUM("glMapBufferRange", target, "target");
+    return error::kNoError;
+  }
+
   GLbitfield mask = GL_MAP_INVALIDATE_BUFFER_BIT;
   if ((access & mask) == mask) {
     // TODO(zmo): To be on the safe side, always map
@@ -15680,6 +15685,11 @@ error::Error GLES2DecoderImpl::HandleUnmapBuffer(
       *static_cast<const gles2::cmds::UnmapBuffer*>(cmd_data);
   GLenum target = static_cast<GLenum>(c.target);
 
+  if (!validators_->buffer_target.IsValid(target)) {
+    LOCAL_SET_GL_ERROR_INVALID_ENUM("glMapBufferRange", target, "target");
+    return error::kNoError;
+  }
+
   Buffer* buffer = buffer_manager()->GetBufferInfoForTarget(&state_, target);
   if (!buffer) {
     LOCAL_SET_GL_ERROR(GL_INVALID_OPERATION, "UnmapBuffer", "no buffer bound");

gpu/command_buffer/service/gles2_cmd_decoder_unittest_buffers.cc

@@ -516,5 +516,40 @@ TEST_P(GLES2DecoderTest, DeleteBuffersDestroysDataStore) {
   }
 }
 
+TEST_P(GLES2DecoderTest, MapUnmapBufferInvalidTarget) {
+  const GLenum kTarget = GL_TEXTURE_2D;
+  const GLintptr kOffset = 10;
+  const GLsizeiptr kSize = 64;
+  const GLbitfield kAccess = GL_MAP_WRITE_BIT;
+
+  uint32_t result_shm_id = kSharedMemoryId;
+  uint32_t result_shm_offset = kSharedMemoryOffset;
+  uint32_t data_shm_id = kSharedMemoryId;
+  // uint32_t is Result for both MapBufferRange and UnmapBuffer commands.
+  uint32_t data_shm_offset = kSharedMemoryOffset + sizeof(uint32_t);
+
+  decoder_->set_unsafe_es3_apis_enabled(true);
+
+  typedef MapBufferRange::Result Result;
+  Result* result = GetSharedMemoryAs<Result*>();
+
+  {
+    MapBufferRange cmd;
+    cmd.Init(kTarget, kOffset, kSize, kAccess, data_shm_id, data_shm_offset,
+             result_shm_id, result_shm_offset);
+    *result = 0;
+    EXPECT_EQ(error::kNoError, ExecuteCmd(cmd));
+    EXPECT_EQ(0u, *result);
+    EXPECT_EQ(GL_INVALID_ENUM, GetGLError());
+  }
+
+  {
+    UnmapBuffer cmd;
+    cmd.Init(kTarget);
+    EXPECT_EQ(error::kNoError, ExecuteCmd(cmd));
+    EXPECT_EQ(GL_INVALID_ENUM, GetGLError());
+  }
+}
+
 }  // namespace gles2
 }  // namespace gpu