Bug 122610 – Validate uniform input when setting texture sampler uniforms

• Status: RESOLVED
• Resolution: FIXED
• Component: WebGL

[Roger Fong]

We have to make sure when we set a texture sampler that the value is less than the max combined texture units, otherwise we throw an INVALID_VALUE error.

The conformance test, conformance/uniforms/uniform-samplers-test.html, covers this.

[Roger Fong]

Fix relies on https://bugs.webkit.org/show_bug.cgi?id=122607 to be committed first.

[Roger Fong]

Created attachment 213923 [details]
Patch

[Dean Jackson]

Comment on attachment 213923 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=213923&action=review

> Source/WebCore/html/canvas/WebGLRenderingContext.cpp:4170
> +        for (unsigned ii = 0; ii < v->length(); ++ii) {

Is there a reason for ii vs i here?

> Source/WebCore/html/canvas/WebGLRenderingContext.cpp:4171
> +            if (((GC3Dint*)v)[ii] >= (int)m_textureUnits.size()) {

Might as well use static_cast

> Source/WebCore/html/canvas/WebGLRenderingContext.cpp:4189
> +    if (location->type() == GraphicsContext3D::SAMPLER_2D || location->type() == GraphicsContext3D::SAMPLER_CUBE)
> +        for (unsigned ii = 0; ii < (unsigned)size; ++ii) {
> +            if (((GC3Dint*)v)[ii] >= (int)m_textureUnits.size()) {

Same.

[Roger Fong]

(In reply to comment #3)
> (From update of attachment 213923 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=213923&action=review
> 
> > Source/WebCore/html/canvas/WebGLRenderingContext.cpp:4170
> > +        for (unsigned ii = 0; ii < v->length(); ++ii) {
> 
> Is there a reason for ii vs i here?
Eh, just saw it in a number of places in the file. There are also plenty of just i's though. I can change.

> 
> > Source/WebCore/html/canvas/WebGLRenderingContext.cpp:4171
> > +            if (((GC3Dint*)v)[ii] >= (int)m_textureUnits.size()) {
> 
> Might as well use static_cast
> 
> > Source/WebCore/html/canvas/WebGLRenderingContext.cpp:4189
> > +    if (location->type() == GraphicsContext3D::SAMPLER_2D || location->type() == GraphicsContext3D::SAMPLER_CUBE)
> > +        for (unsigned ii = 0; ii < (unsigned)size; ++ii) {
> > +            if (((GC3Dint*)v)[ii] >= (int)m_textureUnits.size()) {
> 
> Same.

KK

[Roger Fong]

Committed with fixes: http://trac.webkit.org/changeset/157271