[Backport] Fix for CVE-2019-5817

Fix OOB access for dynamic attribs with offsets.

We were not properly adding the offset to compute the right bounds.

Bug: chromium:943709
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/1548441
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/1545528
Change-Id: I93e714b46dd366d5833fffa858ea3ab0322ffa92
Reviewed-by: Michael Brüning <michael.bruning@qt.io>

4 files changed, 200 insertions, 111 deletions

diff --git a/chromium/third_party/angle/src/libANGLE/renderer/copyvertex.h b/chromium/third_party/angle/src/libANGLE/renderer/copyvertex.h
index 7769a4f7f33..988e590f3b2 100644
--- a/chromium/third_party/angle/src/libANGLE/renderer/copyvertex.h
+++ b/chromium/third_party/angle/src/libANGLE/renderer/copyvertex.h
@@ -24,40 +24,34 @@ template <typename T,
           size_t inputComponentCount,
           size_t outputComponentCount,
           uint32_t alphaDefaultValueBits>
-inline void CopyNativeVertexData(const uint8_t *input,
+void CopyNativeVertexData(const uint8_t *input, size_t stride, size_t count, uint8_t *output);
+
+template <size_t inputComponentCount, size_t outputComponentCount>
+void Copy8SintTo16SintVertexData(const uint8_t *input,
                                  size_t stride,
                                  size_t count,
                                  uint8_t *output);
 
-template <size_t inputComponentCount, size_t outputComponentCount>
-inline void Copy8SintTo16SintVertexData(const uint8_t *input,
-                                        size_t stride,
-                                        size_t count,
-                                        uint8_t *output);
-
 template <size_t componentCount>
-inline void Copy8SnormTo16SnormVertexData(const uint8_t *input,
-                                          size_t stride,
-                                          size_t count,
-                                          uint8_t *output);
+void Copy8SnormTo16SnormVertexData(const uint8_t *input,
+                                   size_t stride,
+                                   size_t count,
+                                   uint8_t *output);
 
 template <size_t inputComponentCount, size_t outputComponentCount>
-inline void Copy32FixedTo32FVertexData(const uint8_t *input,
-                                       size_t stride,
-                                       size_t count,
-                                       uint8_t *output);
+void Copy32FixedTo32FVertexData(const uint8_t *input, size_t stride, size_t count, uint8_t *output);
 
 template <typename T, size_t inputComponentCount, size_t outputComponentCount, bool normalized>
-inline void CopyTo32FVertexData(const uint8_t *input, size_t stride, size_t count, uint8_t *output);
+void CopyTo32FVertexData(const uint8_t *input, size_t stride, size_t count, uint8_t *output);
 
 template <bool isSigned, bool normalized, bool toFloat>
-inline void CopyXYZ10W2ToXYZW32FVertexData(const uint8_t *input,
-                                           size_t stride,
-                                           size_t count,
-                                           uint8_t *output);
+void CopyXYZ10W2ToXYZW32FVertexData(const uint8_t *input,
+                                    size_t stride,
+                                    size_t count,
+                                    uint8_t *output);
 
 }  // namespace rx
 
-#include "copyvertex.inc"
+#include "copyvertex.inc.h"
 
 #endif  // LIBANGLE_RENDERER_COPYVERTEX_H_
diff --git a/chromium/third_party/angle/src/libANGLE/renderer/copyvertex.inc b/chromium/third_party/angle/src/libANGLE/renderer/copyvertex.inc.h
index 7c3e73e59b7..16c82adcf22 100644
--- a/chromium/third_party/angle/src/libANGLE/renderer/copyvertex.inc
+++ b/chromium/third_party/angle/src/libANGLE/renderer/copyvertex.inc.h
@@ -4,15 +4,18 @@
 // found in the LICENSE file.
 //
 
-// copyvertex.inc: Implementation of vertex buffer copying and conversion functions
+// copyvertex.inc.h: Implementation of vertex buffer copying and conversion functions
 
 namespace rx
 {
 
-template <typename T, size_t inputComponentCount, size_t outputComponentCount, uint32_t alphaDefaultValueBits>
+template <typename T,
+          size_t inputComponentCount,
+          size_t outputComponentCount,
+          uint32_t alphaDefaultValueBits>
 inline void CopyNativeVertexData(const uint8_t *input, size_t stride, size_t count, uint8_t *output)
 {
-    const size_t attribSize = sizeof(T)* inputComponentCount;
+    const size_t attribSize = sizeof(T) * inputComponentCount;
 
     if (attribSize == stride && inputComponentCount == outputComponentCount)
     {
@@ -24,21 +27,21 @@ inline void CopyNativeVertexData(const uint8_t *input, size_t stride, size_t cou
     {
         for (size_t i = 0; i < count; i++)
         {
-            const T *offsetInput = reinterpret_cast<const T*>(input + (i * stride));
-            T *offsetOutput = reinterpret_cast<T*>(output) + i * outputComponentCount;
+            const T *offsetInput = reinterpret_cast<const T *>(input + (i * stride));
+            T *offsetOutput      = reinterpret_cast<T *>(output) + i * outputComponentCount;
 
             memcpy(offsetOutput, offsetInput, attribSize);
         }
         return;
     }
 
-    const T defaultAlphaValue = gl::bitCast<T>(alphaDefaultValueBits);
+    const T defaultAlphaValue                = gl::bitCast<T>(alphaDefaultValueBits);
     const size_t lastNonAlphaOutputComponent = std::min<size_t>(outputComponentCount, 3);
 
     for (size_t i = 0; i < count; i++)
     {
-        const T *offsetInput = reinterpret_cast<const T*>(input + (i * stride));
-        T *offsetOutput = reinterpret_cast<T*>(output) + i * outputComponentCount;
+        const T *offsetInput = reinterpret_cast<const T *>(input + (i * stride));
+        T *offsetOutput      = reinterpret_cast<T *>(output) + i * outputComponentCount;
 
         memcpy(offsetOutput, offsetInput, attribSize);
 
@@ -58,14 +61,17 @@ inline void CopyNativeVertexData(const uint8_t *input, size_t stride, size_t cou
 }
 
 template <size_t inputComponentCount, size_t outputComponentCount>
-inline void Copy8SintTo16SintVertexData(const uint8_t *input, size_t stride, size_t count, uint8_t *output)
+inline void Copy8SintTo16SintVertexData(const uint8_t *input,
+                                        size_t stride,
+                                        size_t count,
+                                        uint8_t *output)
 {
     const size_t lastNonAlphaOutputComponent = std::min<size_t>(outputComponentCount, 3);
 
     for (size_t i = 0; i < count; i++)
     {
-        const GLbyte *offsetInput = reinterpret_cast<const GLbyte*>(input + i * stride);
-        GLshort *offsetOutput = reinterpret_cast<GLshort*>(output)+i * outputComponentCount;
+        const GLbyte *offsetInput = reinterpret_cast<const GLbyte *>(input + i * stride);
+        GLshort *offsetOutput     = reinterpret_cast<GLshort *>(output) + i * outputComponentCount;
 
         for (size_t j = 0; j < inputComponentCount; j++)
         {
@@ -87,20 +93,25 @@ inline void Copy8SintTo16SintVertexData(const uint8_t *input, size_t stride, siz
 }
 
 template <size_t inputComponentCount, size_t outputComponentCount>
-inline void Copy8SnormTo16SnormVertexData(const uint8_t *input, size_t stride, size_t count, uint8_t *output)
+inline void Copy8SnormTo16SnormVertexData(const uint8_t *input,
+                                          size_t stride,
+                                          size_t count,
+                                          uint8_t *output)
 {
     for (size_t i = 0; i < count; i++)
     {
-        const GLbyte *offsetInput = reinterpret_cast<const GLbyte*>(input + i * stride);
-        GLshort *offsetOutput = reinterpret_cast<GLshort*>(output) + i * outputComponentCount;
+        const GLbyte *offsetInput = reinterpret_cast<const GLbyte *>(input + i * stride);
+        GLshort *offsetOutput     = reinterpret_cast<GLshort *>(output) + i * outputComponentCount;
 
         for (size_t j = 0; j < inputComponentCount; j++)
         {
             // The original GLbyte value ranges from -128 to +127 (INT8_MAX).
-            // When converted to GLshort, the value must be scaled to between -32768 and +32767 (INT16_MAX).
+            // When converted to GLshort, the value must be scaled to between -32768 and +32767
+            // (INT16_MAX).
             if (offsetInput[j] > 0)
             {
-                offsetOutput[j] = offsetInput[j] << 8 | offsetInput[j] << 1 | ((offsetInput[j] & 0x40) >> 6);
+                offsetOutput[j] =
+                    offsetInput[j] << 8 | offsetInput[j] << 1 | ((offsetInput[j] & 0x40) >> 6);
             }
             else
             {
@@ -123,7 +134,10 @@ inline void Copy8SnormTo16SnormVertexData(const uint8_t *input, size_t stride, s
 }
 
 template <size_t inputComponentCount, size_t outputComponentCount>
-inline void Copy32FixedTo32FVertexData(const uint8_t *input, size_t stride, size_t count, uint8_t *output)
+inline void Copy32FixedTo32FVertexData(const uint8_t *input,
+                                       size_t stride,
+                                       size_t count,
+                                       uint8_t *output)
 {
     static const float divisor = 1.0f / (1 << 16);
 
@@ -153,7 +167,8 @@ inline void Copy32FixedTo32FVertexData(const uint8_t *input, size_t stride, size
 
         // 4-component output formats would need special padding in the alpha channel.
         static_assert(!(inputComponentCount < 4 && outputComponentCount == 4),
-                      "An inputComponentCount less than 4 and an outputComponentCount equal to 4 is not supported.");
+                      "An inputComponentCount less than 4 and an outputComponentCount equal to 4 "
+                      "is not supported.");
 
         for (size_t j = inputComponentCount; j < outputComponentCount; j++)
         {
@@ -169,8 +184,8 @@ inline void CopyTo32FVertexData(const uint8_t *input, size_t stride, size_t coun
 
     for (size_t i = 0; i < count; i++)
     {
-        const T *offsetInput = reinterpret_cast<const T*>(input + (stride * i));
-        float *offsetOutput = reinterpret_cast<float*>(output) + i * outputComponentCount;
+        const T *offsetInput = reinterpret_cast<const T *>(input + (stride * i));
+        float *offsetOutput  = reinterpret_cast<float *>(output) + i * outputComponentCount;
 
         for (size_t j = 0; j < inputComponentCount; j++)
         {
@@ -179,22 +194,23 @@ inline void CopyTo32FVertexData(const uint8_t *input, size_t stride, size_t coun
                 if (NL::is_signed)
                 {
                     const float divisor = 1.0f / (2 * static_cast<float>(NL::max()) + 1);
-                    offsetOutput[j] = (2 * static_cast<float>(offsetInput[j]) + 1) * divisor;
+                    offsetOutput[j]     = (2 * static_cast<float>(offsetInput[j]) + 1) * divisor;
                 }
                 else
                 {
-                    offsetOutput[j] =  static_cast<float>(offsetInput[j]) / NL::max();
+                    offsetOutput[j] = static_cast<float>(offsetInput[j]) / NL::max();
                 }
             }
             else
             {
-                offsetOutput[j] =  static_cast<float>(offsetInput[j]);
+                offsetOutput[j] = static_cast<float>(offsetInput[j]);
             }
         }
 
         // This would require special padding.
         static_assert(!(inputComponentCount < 4 && outputComponentCount == 4),
-                      "An inputComponentCount less than 4 and an outputComponentCount equal to 4 is not supported.");
+                      "An inputComponentCount less than 4 and an outputComponentCount equal to 4 "
+                      "is not supported.");
 
         for (size_t j = inputComponentCount; j < outputComponentCount; j++)
         {
@@ -209,19 +225,19 @@ namespace priv
 template <bool isSigned, bool normalized, bool toFloat>
 static inline void CopyPackedRGB(uint32_t data, uint8_t *output)
 {
-    const uint32_t rgbSignMask = 0x200;       // 1 set at the 9 bit
-    const uint32_t negativeMask = 0xFFFFFC00; // All bits from 10 to 31 set to 1
+    const uint32_t rgbSignMask  = 0x200;       // 1 set at the 9 bit
+    const uint32_t negativeMask = 0xFFFFFC00;  // All bits from 10 to 31 set to 1
 
     if (toFloat)
     {
-        GLfloat *floatOutput = reinterpret_cast<GLfloat*>(output);
+        GLfloat *floatOutput = reinterpret_cast<GLfloat *>(output);
         if (isSigned)
         {
             GLfloat finalValue = 0;
             if (data & rgbSignMask)
             {
                 int negativeNumber = data | negativeMask;
-                finalValue = static_cast<GLfloat>(negativeNumber);
+                finalValue         = static_cast<GLfloat>(negativeNumber);
             }
             else
             {
@@ -230,19 +246,19 @@ static inline void CopyPackedRGB(uint32_t data, uint8_t *output)
 
             if (normalized)
             {
-                const int32_t maxValue = 0x1FF;      // 1 set in bits 0 through 8
-                const int32_t minValue = 0xFFFFFE01; // Inverse of maxValue
+                const int32_t maxValue = 0x1FF;       // 1 set in bits 0 through 8
+                const int32_t minValue = 0xFFFFFE01;  // Inverse of maxValue
 
                 // A 10-bit two's complement number has the possibility of being minValue - 1 but
-                // OpenGL's normalization rules dictate that it should be clamped to minValue in this
-                // case.
+                // OpenGL's normalization rules dictate that it should be clamped to minValue in
+                // this case.
                 if (finalValue < minValue)
                 {
                     finalValue = minValue;
                 }
 
                 const int32_t halfRange = (maxValue - minValue) >> 1;
-                *floatOutput = ((finalValue - minValue) / halfRange) - 1.0f;
+                *floatOutput            = ((finalValue - minValue) / halfRange) - 1.0f;
             }
             else
             {
@@ -253,7 +269,7 @@ static inline void CopyPackedRGB(uint32_t data, uint8_t *output)
         {
             if (normalized)
             {
-                const uint32_t maxValue = 0x3FF; // 1 set in bits 0 through 9
+                const uint32_t maxValue = 0x3FF;  // 1 set in bits 0 through 9
                 *floatOutput = static_cast<GLfloat>(data) / static_cast<GLfloat>(maxValue);
             }
             else
@@ -266,7 +282,7 @@ static inline void CopyPackedRGB(uint32_t data, uint8_t *output)
     {
         if (isSigned)
         {
-            GLshort *intOutput = reinterpret_cast<GLshort*>(output);
+            GLshort *intOutput = reinterpret_cast<GLshort *>(output);
 
             if (data & rgbSignMask)
             {
@@ -279,8 +295,8 @@ static inline void CopyPackedRGB(uint32_t data, uint8_t *output)
         }
         else
         {
-            GLushort *uintOutput = reinterpret_cast<GLushort*>(output);
-            *uintOutput = static_cast<GLushort>(data);
+            GLushort *uintOutput = reinterpret_cast<GLushort *>(output);
+            *uintOutput          = static_cast<GLushort>(data);
         }
     }
 }
@@ -290,29 +306,47 @@ inline void CopyPackedAlpha(uint32_t data, uint8_t *output)
 {
     if (toFloat)
     {
-        GLfloat *floatOutput = reinterpret_cast<GLfloat*>(output);
+        GLfloat *floatOutput = reinterpret_cast<GLfloat *>(output);
         if (isSigned)
         {
             if (normalized)
             {
                 switch (data)
                 {
-                  case 0x0: *floatOutput =  0.0f; break;
-                  case 0x1: *floatOutput =  1.0f; break;
-                  case 0x2: *floatOutput = -1.0f; break;
-                  case 0x3: *floatOutput = -1.0f; break;
-                  default: UNREACHABLE();
+                    case 0x0:
+                        *floatOutput = 0.0f;
+                        break;
+                    case 0x1:
+                        *floatOutput = 1.0f;
+                        break;
+                    case 0x2:
+                        *floatOutput = -1.0f;
+                        break;
+                    case 0x3:
+                        *floatOutput = -1.0f;
+                        break;
+                    default:
+                        UNREACHABLE();
                 }
             }
             else
             {
                 switch (data)
                 {
-                  case 0x0: *floatOutput =  0.0f; break;
-                  case 0x1: *floatOutput =  1.0f; break;
-                  case 0x2: *floatOutput = -2.0f; break;
-                  case 0x3: *floatOutput = -1.0f; break;
-                  default: UNREACHABLE();
+                    case 0x0:
+                        *floatOutput = 0.0f;
+                        break;
+                    case 0x1:
+                        *floatOutput = 1.0f;
+                        break;
+                    case 0x2:
+                        *floatOutput = -2.0f;
+                        break;
+                    case 0x3:
+                        *floatOutput = -1.0f;
+                        break;
+                    default:
+                        UNREACHABLE();
                 }
             }
         }
@@ -322,22 +356,40 @@ inline void CopyPackedAlpha(uint32_t data, uint8_t *output)
             {
                 switch (data)
                 {
-                  case 0x0: *floatOutput = 0.0f / 3.0f; break;
-                  case 0x1: *floatOutput = 1.0f / 3.0f; break;
-                  case 0x2: *floatOutput = 2.0f / 3.0f; break;
-                  case 0x3: *floatOutput = 3.0f / 3.0f; break;
-                  default: UNREACHABLE();
+                    case 0x0:
+                        *floatOutput = 0.0f / 3.0f;
+                        break;
+                    case 0x1:
+                        *floatOutput = 1.0f / 3.0f;
+                        break;
+                    case 0x2:
+                        *floatOutput = 2.0f / 3.0f;
+                        break;
+                    case 0x3:
+                        *floatOutput = 3.0f / 3.0f;
+                        break;
+                    default:
+                        UNREACHABLE();
                 }
             }
             else
             {
                 switch (data)
                 {
-                  case 0x0: *floatOutput = 0.0f; break;
-                  case 0x1: *floatOutput = 1.0f; break;
-                  case 0x2: *floatOutput = 2.0f; break;
-                  case 0x3: *floatOutput = 3.0f; break;
-                  default: UNREACHABLE();
+                    case 0x0:
+                        *floatOutput = 0.0f;
+                        break;
+                    case 0x1:
+                        *floatOutput = 1.0f;
+                        break;
+                    case 0x2:
+                        *floatOutput = 2.0f;
+                        break;
+                    case 0x3:
+                        *floatOutput = 3.0f;
+                        break;
+                    default:
+                        UNREACHABLE();
                 }
             }
         }
@@ -346,57 +398,82 @@ inline void CopyPackedAlpha(uint32_t data, uint8_t *output)
     {
         if (isSigned)
         {
-            GLshort *intOutput = reinterpret_cast<GLshort*>(output);
+            GLshort *intOutput = reinterpret_cast<GLshort *>(output);
             switch (data)
             {
-              case 0x0: *intOutput =  0; break;
-              case 0x1: *intOutput =  1; break;
-              case 0x2: *intOutput = -2; break;
-              case 0x3: *intOutput = -1; break;
-              default: UNREACHABLE();
+                case 0x0:
+                    *intOutput = 0;
+                    break;
+                case 0x1:
+                    *intOutput = 1;
+                    break;
+                case 0x2:
+                    *intOutput = -2;
+                    break;
+                case 0x3:
+                    *intOutput = -1;
+                    break;
+                default:
+                    UNREACHABLE();
             }
         }
         else
         {
-            GLushort *uintOutput = reinterpret_cast<GLushort*>(output);
+            GLushort *uintOutput = reinterpret_cast<GLushort *>(output);
             switch (data)
             {
-              case 0x0: *uintOutput = 0; break;
-              case 0x1: *uintOutput = 1; break;
-              case 0x2: *uintOutput = 2; break;
-              case 0x3: *uintOutput = 3; break;
-              default: UNREACHABLE();
+                case 0x0:
+                    *uintOutput = 0;
+                    break;
+                case 0x1:
+                    *uintOutput = 1;
+                    break;
+                case 0x2:
+                    *uintOutput = 2;
+                    break;
+                case 0x3:
+                    *uintOutput = 3;
+                    break;
+                default:
+                    UNREACHABLE();
             }
         }
     }
 }
 
-}
+}  // namespace priv
 
 template <bool isSigned, bool normalized, bool toFloat>
-inline void CopyXYZ10W2ToXYZW32FVertexData(const uint8_t *input, size_t stride, size_t count, uint8_t *output)
+inline void CopyXYZ10W2ToXYZW32FVertexData(const uint8_t *input,
+                                           size_t stride,
+                                           size_t count,
+                                           uint8_t *output)
 {
     const size_t outputComponentSize = toFloat ? 4 : 2;
-    const size_t componentCount = 4;
+    const size_t componentCount      = 4;
 
-    const uint32_t rgbMask = 0x3FF; // 1 set in bits 0 through 9
-    const size_t redShift = 0;    // red is bits 0 through 9
-    const size_t greenShift = 10; // green is bits 10 through 19
-    const size_t blueShift = 20;  // blue is bits 20 through 29
+    const uint32_t rgbMask  = 0x3FF;  // 1 set in bits 0 through 9
+    const size_t redShift   = 0;      // red is bits 0 through 9
+    const size_t greenShift = 10;     // green is bits 10 through 19
+    const size_t blueShift  = 20;     // blue is bits 20 through 29
 
-    const uint32_t alphaMask = 0x3; // 1 set in bits 0 and 1
-    const size_t alphaShift = 30; // Alpha is the 30 and 31 bits
+    const uint32_t alphaMask = 0x3;  // 1 set in bits 0 and 1
+    const size_t alphaShift  = 30;   // Alpha is the 30 and 31 bits
 
     for (size_t i = 0; i < count; i++)
     {
-        GLuint packedValue = *reinterpret_cast<const GLuint*>(input + (i * stride));
+        GLuint packedValue    = *reinterpret_cast<const GLuint *>(input + (i * stride));
         uint8_t *offsetOutput = output + (i * outputComponentSize * componentCount);
 
-        priv::CopyPackedRGB<isSigned, normalized, toFloat>(  (packedValue >> redShift)   & rgbMask,   offsetOutput + (0 * outputComponentSize));
-        priv::CopyPackedRGB<isSigned, normalized, toFloat>(  (packedValue >> greenShift) & rgbMask,   offsetOutput + (1 * outputComponentSize));
-        priv::CopyPackedRGB<isSigned, normalized, toFloat>(  (packedValue >> blueShift)  & rgbMask,   offsetOutput + (2 * outputComponentSize));
-        priv::CopyPackedAlpha<isSigned, normalized, toFloat>((packedValue >> alphaShift) & alphaMask, offsetOutput + (3 * outputComponentSize));
+        priv::CopyPackedRGB<isSigned, normalized, toFloat>(
+            (packedValue >> redShift) & rgbMask, offsetOutput + (0 * outputComponentSize));
+        priv::CopyPackedRGB<isSigned, normalized, toFloat>(
+            (packedValue >> greenShift) & rgbMask, offsetOutput + (1 * outputComponentSize));
+        priv::CopyPackedRGB<isSigned, normalized, toFloat>(
+            (packedValue >> blueShift) & rgbMask, offsetOutput + (2 * outputComponentSize));
+        priv::CopyPackedAlpha<isSigned, normalized, toFloat>(
+            (packedValue >> alphaShift) & alphaMask, offsetOutput + (3 * outputComponentSize));
     }
 }
 
-}
+}  // namespace rx
diff --git a/chromium/third_party/angle/src/libANGLE/renderer/d3d/VertexDataManager.cpp b/chromium/third_party/angle/src/libANGLE/renderer/d3d/VertexDataManager.cpp
index 527f1942859..c22d7cfdcbd 100644
--- a/chromium/third_party/angle/src/libANGLE/renderer/d3d/VertexDataManager.cpp
+++ b/chromium/third_party/angle/src/libANGLE/renderer/d3d/VertexDataManager.cpp
@@ -37,7 +37,23 @@ enum
     CONSTANT_VERTEX_BUFFER_SIZE = 4096
 };
 
-// Warning: you should ensure binding really matches attrib.bindingIndex before using this function.
+// Warning: ensure the binding matches attrib.bindingIndex before using these functions.
+int64_t GetMaxAttributeByteOffsetForDraw(const gl::VertexAttribute &attrib,
+                                         const gl::VertexBinding &binding,
+                                         int64_t elementCount)
+{
+    CheckedNumeric<int64_t> stride = ComputeVertexAttributeStride(attrib, binding);
+    CheckedNumeric<int64_t> offset = ComputeVertexAttributeOffset(attrib, binding);
+    CheckedNumeric<int64_t> size   = ComputeVertexAttributeTypeSize(attrib);
+
+    ASSERT(elementCount > 0);
+
+    CheckedNumeric<int64_t> result =
+        stride * (CheckedNumeric<int64_t>(elementCount) - 1) + size + offset;
+    return result.ValueOrDefault(std::numeric_limits<int64_t>::max());
+}
+
+// Warning: ensure the binding matches attrib.bindingIndex before using these functions.
 int ElementsInBuffer(const gl::VertexAttribute &attrib,
                      const gl::VertexBinding &binding,
                      unsigned int size)
@@ -482,10 +498,12 @@ angle::Result VertexDataManager::reserveSpaceForAttrib(const gl::Context *contex
         GLint firstVertexIndex = binding.getDivisor() > 0 ? 0 : start;
         int64_t maxVertexCount =
             static_cast<int64_t>(firstVertexIndex) + static_cast<int64_t>(totalCount);
-        int elementsInBuffer =
-            ElementsInBuffer(attrib, binding, static_cast<unsigned int>(bufferD3D->getSize()));
 
-        ANGLE_CHECK(GetImplAs<ContextD3D>(context), maxVertexCount <= elementsInBuffer,
+        int64_t maxByte = GetMaxAttributeByteOffsetForDraw(attrib, binding, maxVertexCount);
+
+        ASSERT(bufferD3D->getSize() <= static_cast<size_t>(std::numeric_limits<int64_t>::max()));
+        ANGLE_CHECK(GetImplAs<ContextD3D>(context),
+                    maxByte <= static_cast<int64_t>(bufferD3D->getSize()),
                     "Vertex buffer is not big enough for the draw call.", GL_INVALID_OPERATION);
     }
     return mStreamingBuffer.reserveVertexSpace(context, attrib, binding, totalCount, instances);
diff --git a/chromium/third_party/angle/src/libGLESv2.gni b/chromium/third_party/angle/src/libGLESv2.gni
index cc6676a94a9..a7170e3252c 100644
--- a/chromium/third_party/angle/src/libGLESv2.gni
+++ b/chromium/third_party/angle/src/libGLESv2.gni
@@ -304,7 +304,7 @@ libangle_sources = [
   "src/libANGLE/renderer/TransformFeedbackImpl.h",
   "src/libANGLE/renderer/VertexArrayImpl.h",
   "src/libANGLE/renderer/copyvertex.h",
-  "src/libANGLE/renderer/copyvertex.inc",
+  "src/libANGLE/renderer/copyvertex.inc.h",
   "src/libANGLE/renderer/load_functions_table.h",
   "src/libANGLE/renderer/load_functions_table_autogen.cpp",
   "src/libANGLE/renderer/renderer_utils.cpp",