已开启
[ArkWeb][安全][上游社区漏洞修复][BUG-485622239] 修复Vulkan纹理尺寸溢出 #458
。创建于 20 天前
[ArkWeb][安全][上游社区漏洞修复][BUG-485622239] 修复Vulkan纹理尺寸溢出 #458
已开启
共 1 个文件变更+11-3
| @@ -3095,9 +3095,17 @@ angle::Result TextureVk::reinitImageAsRenderable(ContextVk *contextVk, const vk: | |||
| 3095 | // invalidate must be called after wait for finish. | 3095 | // invalidate must be called after wait for finish. |
| 3096 | ANGLE_TRY(srcBuffer->invalidate(renderer)); | 3096 | ANGLE_TRY(srcBuffer->invalidate(renderer)); |
| 3097 | 3097 | ||
| 3098 | - size_t dstBufferSize = | 3098 | + // Use size_t calculations to avoid 32-bit overflows. Note that the dimensions are bound by |
| 3099 | - static_cast<size_t>(sourceBox.width) * static_cast<size_t>(sourceBox.height) * | 3099 | + // the maximums specified in Constants.h, and that gl::Box members are signed 32-bit |
| 3100 | - static_cast<size_t>(sourceBox.depth) * dstFormat.pixelBytes * copyLayerCount; | 3100 | + // integers. |
| 3101 | + static_assert(gl::IMPLEMENTATION_MAX_2D_TEXTURE_SIZE * | ||
| 3102 | + gl::IMPLEMENTATION_MAX_2D_TEXTURE_SIZE < | ||
| 3103 | + std::numeric_limits<int32_t>::max()); | ||
| 3104 | + size_t dstBufferSize = sourceBox.width * sourceBox.height; | ||
| 3105 | + static_assert(gl::IMPLEMENTATION_MAX_3D_TEXTURE_SIZE * | ||
| 3106 | + gl::IMPLEMENTATION_MAX_2D_ARRAY_TEXTURE_LAYERS * 16 < | ||
| 3107 | + std::numeric_limits<int32_t>::max()); | ||
| 3108 | + dstBufferSize *= sourceBox.depth * dstFormat.pixelBytes * copyLayerCount; | ||
| 3101 | 3109 | ||
| 3102 | // Allocate memory in the destination texture for the copy/conversion. | 3110 | // Allocate memory in the destination texture for the copy/conversion. |
| 3103 | uint8_t *dstData = nullptr; | 3111 | uint8_t *dstData = nullptr; |