1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
|
Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/9632375c6aac
# HG changeset patch
# User Jeff Gilbert <jdashg@gmail.com>
# Date 1453320785 28800
# Node ID 9632375c6aacbf673b996b53231d70b91e480fb5
# Parent ee68c3dae5f639fdd439f69ef2f724067fce0ea6
Limit max buffers size for ANGLE. r=jrmuizel a=lizzard
diff --git a/dom/canvas/WebGLContextBuffers.cpp b/dom/canvas/WebGLContextBuffers.cpp
--- a/dom/canvas/WebGLContextBuffers.cpp
+++ b/dom/canvas/WebGLContextBuffers.cpp
@@ -164,16 +164,19 @@ WebGLContext::BufferData(GLenum target,
if (!ValidateBufferUsageEnum(usage, "bufferData: usage"))
return;
// careful: WebGLsizeiptr is always 64-bit, but GLsizeiptr is like intptr_t.
if (!CheckedInt<GLsizeiptr>(size).isValid())
return ErrorOutOfMemory("bufferData: bad size");
+ if (gl->IsANGLE() && size > UINT32_MAX)
+ return ErrorOutOfMemory("bufferData: size too large");
+
WebGLBuffer* boundBuffer = bufferSlot.get();
if (!boundBuffer)
return ErrorInvalidOperation("bufferData: no buffer bound!");
UniquePtr<uint8_t> zeroBuffer((uint8_t*)moz_calloc(size, 1));
if (!zeroBuffer)
return ErrorOutOfMemory("bufferData: out of memory");
@@ -216,16 +219,19 @@ WebGLContext::BufferData(GLenum target,
const dom::ArrayBuffer& data = maybeData.Value();
data.ComputeLengthAndData();
// Careful: data.Length() could conceivably be any uint32_t, but GLsizeiptr
// is like intptr_t.
if (!CheckedInt<GLsizeiptr>(data.Length()).isValid())
return ErrorOutOfMemory("bufferData: bad size");
+ if (gl->IsANGLE() && data.Length() > UINT32_MAX)
+ return ErrorOutOfMemory("bufferData: size too large");
+
if (!ValidateBufferUsageEnum(usage, "bufferData: usage"))
return;
WebGLBuffer* boundBuffer = bufferSlot.get();
if (!boundBuffer)
return ErrorInvalidOperation("bufferData: no buffer bound!");
@@ -267,16 +273,19 @@ WebGLContext::BufferData(GLenum target,
data.ComputeLengthAndData();
// Careful: data.Length() could conceivably be any uint32_t, but GLsizeiptr
// is like intptr_t.
if (!CheckedInt<GLsizeiptr>(data.Length()).isValid())
return ErrorOutOfMemory("bufferData: bad size");
+ if (gl->IsANGLE() && data.Length() > UINT32_MAX)
+ return ErrorOutOfMemory("bufferData: size too large");
+
InvalidateBufferFetching();
MakeContextCurrent();
GLenum error = CheckedBufferData(target, data.Length(), data.Data(), usage);
if (error) {
GenerateWarning("bufferData generated error %s", ErrorName(error));
return;
}
|
