diff options
| author | Shahbaz Youssefi <syoussefi@chromium.org> | 2022-01-31 12:07:43 -0500 |
|---|---|---|
| committer | Michael Brüning <michael.bruning@qt.io> | 2022-03-03 16:58:30 +0000 |
| commit | 64eed873ab5970ffc03d230fa39d61510b8569c1 (patch) | |
| tree | cf3d7ee4770d5a891a9772cd5322f1b9171280c3 | |
| parent | 2daead9ef36094dbf5630ce0d178b38c57825c3c (diff) | |
| download | qtwebengine-chromium-64eed873ab5970ffc03d230fa39d61510b8569c1.tar.gz | |
[Backport] CVE-2022-0606: Use after free in ANGLE
Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/angle/angle/+/3427561:
Vulkan: Fix vkCmdResolveImage extents
The source framebuffer's extents were accidentally used instead of the
blit area extents.
Bug: chromium:1288020
Change-Id: Ib723db50d9687fee0453d027141a94ea26d8a4b8
Reviewed-by: Jamie Madill <jmadill@chromium.org>
Commit-Queue: Shahbaz Youssefi <syoussefi@chromium.org>
Reviewed-by: Michal Klocek <michal.klocek@qt.io>
| -rw-r--r-- | chromium/third_party/angle/src/libANGLE/renderer/vulkan/FramebufferVk.cpp | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/chromium/third_party/angle/src/libANGLE/renderer/vulkan/FramebufferVk.cpp b/chromium/third_party/angle/src/libANGLE/renderer/vulkan/FramebufferVk.cpp index d2c07b2deb0..86c6f2e1fc4 100644 --- a/chromium/third_party/angle/src/libANGLE/renderer/vulkan/FramebufferVk.cpp +++ b/chromium/third_party/angle/src/libANGLE/renderer/vulkan/FramebufferVk.cpp @@ -1345,8 +1345,8 @@ angle::Result FramebufferVk::resolveColorWithCommand(ContextVk *contextVk, resolveRegion.dstOffset.x = params.blitArea.x; resolveRegion.dstOffset.y = params.blitArea.y; resolveRegion.dstOffset.z = 0; - resolveRegion.extent.width = params.srcExtents[0]; - resolveRegion.extent.height = params.srcExtents[1]; + resolveRegion.extent.width = params.blitArea.width; + resolveRegion.extent.height = params.blitArea.height; resolveRegion.extent.depth = 1; vk::PerfCounters &perfCounters = contextVk->getPerfCounters(); |