commit 98910efe0a15f6ad50d235434e86f44b4ace5919
author Lingfeng Yang <lfy@google.com> Sat Jun 13 04:26:51 2020 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Sat Jun 13 04:26:51 2020 +0000
tree 40b46f29f2c8710b8a9fc025957857fe67d7c747
parent fc9b9b0160c78b2150e46b7c96ea98ee9b5d9e16
parent 6c667b4fb6521361d94a4f16c945fb8384f22625

Add checks to glDrawElementsInstanced, glGetShaderSource am: 6c667b4fb6

Original change: https://googleplex-android-review.googlesource.com/c/device/generic/goldfish-opengl/+/11854593

Change-Id: Ifb330fba21fdbf5a4568646a0bb2d2874acf2286

system/GLESv2_enc/GL2Encoder.cpp

diff --git a/system/GLESv2_enc/GL2Encoder.cpp b/system/GLESv2_enc/GL2Encoder.cpp
index 3ad9420..1f0b7a0 100755
--- a/system/GLESv2_enc/GL2Encoder.cpp
+++ b/system/GLESv2_enc/GL2Encoder.cpp
@@ -1902,7 +1902,10 @@
                 break;
             }
         }
-        memcpy(source, returned.substr(0, bufsize - 1).c_str(), bufsize);
+        std::string ret = returned.substr(0, bufsize - 1);
+
+        size_t toCopy = bufsize < (ret.size() + 1) ? bufsize : ret.size() + 1;
+        memcpy(source, ret.c_str(), toCopy);
     }
 }
 
@@ -4123,6 +4126,7 @@
     assert(ctx->m_state != NULL);
     SET_ERROR_IF(!isValidDrawMode(mode), GL_INVALID_ENUM);
     SET_ERROR_IF(count < 0, GL_INVALID_VALUE);
+    SET_ERROR_IF(primcount < 0, GL_INVALID_VALUE);
 
     bool has_client_vertex_arrays = false;
     bool has_indirect_arrays = false;
@@ -4148,6 +4152,7 @@
     assert(ctx->m_state != NULL);
     SET_ERROR_IF(!isValidDrawMode(mode), GL_INVALID_ENUM);
     SET_ERROR_IF(count < 0, GL_INVALID_VALUE);
+    SET_ERROR_IF(primcount < 0, GL_INVALID_VALUE);
     SET_ERROR_IF(!(type == GL_UNSIGNED_BYTE || type == GL_UNSIGNED_SHORT || type == GL_UNSIGNED_INT), GL_INVALID_ENUM);
     SET_ERROR_IF(ctx->m_state->getTransformFeedbackActiveUnpaused(), GL_INVALID_OPERATION);