Changeset 71903 in vbox for trunk/src/VBox/GuestHost/OpenGL

Timestamp:

Apr 18, 2018 4:22:34 PM (7 years ago)

Author:

vboxsync

Message:

3D: bugref:9096, Chromium code cleanup

Location:

trunk/src/VBox/GuestHost/OpenGL/state_tracker

Files:

• state_client.c (modified) (1 diff)
• state_program.c (modified) (3 diffs)

trunk/src/VBox/GuestHost/OpenGL/state_tracker/state_client.c

@@ -2401 +2401 @@
     CRASSERT(array && index>=0 && index<CRSTATECLIENT_MAX_VERTEXARRAYS);
 
-    if (index<7)
+    if (array == NULL || index < 0 || index >= CRSTATECLIENT_MAX_VERTEXARRAYS)
+    {
+        return NULL;
+    }
+
+    if (index < 7)
     {
         switch (index)

trunk/src/VBox/GuestHost/OpenGL/state_tracker/state_program.c

@@ -692 +692 @@
 
     if (target == GL_VERTEX_PROGRAM_NV) {
+        if (index >= UINT32_MAX - num) {
+            crStateError(__LINE__, __FILE__, GL_INVALID_VALUE,
+                "glProgramParameters4dvNV(index+num) integer overflow");
+            return;
+        }
+
         if (index + num < g->limits.maxVertexProgramEnvParams) {
             GLuint i;
@@ -732 +738 @@
 
     if (target == GL_VERTEX_PROGRAM_NV) {
+        if (index >= UINT32_MAX - num) {
+            crStateError(__LINE__, __FILE__, GL_INVALID_VALUE,
+                "glProgramParameters4dvNV(index+num) integer overflow");
+            return;
+        }
+
         if (index + num < g->limits.maxVertexProgramEnvParams) {
             GLuint i;
@@ -850 +862 @@
         return;
     }
-    
+
     if (target == GL_VERTEX_PROGRAM_NV) {
-        if (address & 0x3) {
-      /* addr must be multiple of four */
-      crStateError(__LINE__, __FILE__, GL_INVALID_VALUE,
+        if (address & 0x3 || address >= g->limits.maxVertexProgramEnvParams) {
+            crStateError(__LINE__, __FILE__, GL_INVALID_VALUE,
                                      "glTrackMatrixNV(address)");
-      return;
+            return;
         }