github/electron
1
1
Fork 0
mirror of https://github.com/electron/electron.git synced 2026-04-10 03:01:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

chore: cherry-pick e60cc80ff744 from chromium (#30228)

Browse Source 
* chore: cherry-pick e60cc80ff744 from chromium

* chore: update patches

Co-authored-by: PatchUp <73610968+patchup[bot]@users.noreply.github.com>
Co-authored-by: Electron Bot <electron@github.com>
This commit is contained in:
Pedro Pontes
2021-07-29 02:24:29 +02:00
committed by GitHub
parent e119871d4e
commit 8f172b0614
2 changed files with 36 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
patches/chromium/.patches
View File

@@ -175,6 +175,7 @@ cherry-pick-b77b38a3380c.patch
cherry-pick-d9556a80a790.patch
cherry-pick-910e9e40d376.patch
cherry-pick-ff0d013f60fa.patch
cherry-pick-e60cc80ff744.patch
fix_use-after-free_with_xslt_strip-space.patch
cherry-pick-3feda0244490.patch
cherry-pick-cd98d7c0dae9.patch

35
patches/chromium/cherry-pick-e60cc80ff744.patch Normal file
View File

@@ -0,0 +1,35 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Shrek Shao <shrekshao@google.com>
Date: Tue, 29 Jun 2021 01:17:03 +0000
Subject: Fix multidraw validation drawcount + offset out of bounds
(cherry picked from commit 7d0a12ce19fed024d56b95a692d888fe3ef14e2f)
Bug: 1219886
Change-Id: I8a84664150758370d9a77ee22ac5549bead0e37e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2977850
Reviewed-by: Kenneth Russell <kbr@chromium.org>
Commit-Queue: Kenneth Russell <kbr@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#895423}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2988885
Reviewed-by: Shrek Shao <shrekshao@google.com>
Reviewed-by: Austin Eng <enga@chromium.org>
Cr-Commit-Position: refs/branch-heads/4515@{#1101}
Cr-Branched-From: 488fc70865ddaa05324ac00a54a6eb783b4bc41c-refs/heads/master@{#885287}
diff --git a/third_party/blink/renderer/modules/webgl/webgl_multi_draw_common.cc b/third_party/blink/renderer/modules/webgl/webgl_multi_draw_common.cc
index 6720d46394ae0346331e133f0fa8d24e5dd1e95b..bae874bbf23cdb497b92bda7bb87429dafe7d5d4 100644
--- a/third_party/blink/renderer/modules/webgl/webgl_multi_draw_common.cc
+++ b/third_party/blink/renderer/modules/webgl/webgl_multi_draw_common.cc
@@ -34,6 +34,11 @@ bool WebGLMultiDrawCommon::ValidateArray(WebGLExtensionScopedContext* scoped,
outOfBoundsDescription);
return false;
}
+ if (static_cast<uint64_t>(drawcount) + offset > size) {
+ scoped->Context()->SynthesizeGLError(GL_INVALID_OPERATION, function_name,
+ "drawcount plus offset out of bounds");
+ return false;
+ }
return true;
}