diff options
| author | Jamie Madill <jmadill@chromium.org> | 2020-07-14 17:20:18 -0400 |
|---|---|---|
| committer | Michael Brüning <michael.bruning@qt.io> | 2020-08-11 14:49:18 +0000 |
| commit | 3cebf422618e308b48639057593ee795685e6cb7 (patch) | |
| tree | 7fe716f6ae5f826bc3ddb7098e2572b35a926a17 | |
| parent | f7859651865c0b4b511714f5d68faac76f6a6d70 (diff) | |
| download | qtwebengine-chromium-3cebf422618e308b48639057593ee795685e6cb7.tar.gz | |
[Backport] CVE-2020-6555: Out of bounds read in WebGL
Manual backport of patch originally reviewed on
https://chromium-review.googlesource.com/c/angle/angle/+/2298145:
Fix stale validation cache on buffer deletion.
When we would delete the currently bound element array buffer we
would neglect to invalidate a specific validation cache variable.
This incorrectly would let us skip buffer size validation and lead
to internal invalid memory accesses.
Bug: chromium:1105202
Change-Id: I23ab28ccd3ac6b5d461cb8745b930f4d42d53b35
Reviewed-by: Geoff Lang <geofflang@chromium.org>
Commit-Queue: Jamie Madill <jmadill@chromium.org>
Reviewed-by: Michal Klocek <michal.klocek@qt.io>
| -rw-r--r-- | chromium/third_party/angle/src/libANGLE/Context.cpp | 1 | ||||
| -rw-r--r-- | chromium/third_party/angle/src/libANGLE/Context.h | 1 |
2 files changed, 2 insertions, 0 deletions
diff --git a/chromium/third_party/angle/src/libANGLE/Context.cpp b/chromium/third_party/angle/src/libANGLE/Context.cpp index 90e80d92b57..f73391da2bd 100644 --- a/chromium/third_party/angle/src/libANGLE/Context.cpp +++ b/chromium/third_party/angle/src/libANGLE/Context.cpp @@ -8702,6 +8702,7 @@ void StateCache::onVertexArrayStateChange(Context *context) updateActiveAttribsMask(context); updateVertexElementLimits(context); updateBasicDrawStatesError(); + updateBasicDrawElementsError(); } void StateCache::onVertexArrayBufferStateChange(Context *context) diff --git a/chromium/third_party/angle/src/libANGLE/Context.h b/chromium/third_party/angle/src/libANGLE/Context.h index 5668bb4f6e8..e9f1cb80447 100644 --- a/chromium/third_party/angle/src/libANGLE/Context.h +++ b/chromium/third_party/angle/src/libANGLE/Context.h @@ -201,6 +201,7 @@ class StateCache final : angle::NonCopyable // 1. onActiveTransformFeedbackChange. // 2. onVertexArrayBufferStateChange. // 3. onBufferBindingChange. + // 4. onVertexArrayStateChange intptr_t getBasicDrawElementsError(Context *context) const { if (mCachedBasicDrawElementsError != kInvalidPointer) |