commit e919b494d5e0dbdbb6ac9ef04fc26d5145a1c763
author Lingfeng Yang <lfy@google.com> Thu Jun 11 19:07:35 2020 -0700
committer Lingfeng Yang <lfy@google.com> Fri Jun 12 09:32:04 2020 -0700
tree 4fafbdd0faa87dc7ddea932adbfd5010c929b5c0
parent 50995658e8360dcf19da906496d0e8fbc9cb4585

Add checks to glDrawElementsInstanced, glGetShaderSource

Bug: 158533223

Change-Id: I8d819b6b5edc10b863e57dda788591cabe34a971

system/GLESv2_enc/GL2Encoder.cpp

diff --git a/system/GLESv2_enc/GL2Encoder.cpp b/system/GLESv2_enc/GL2Encoder.cpp
index 3ad9420..1f0b7a0 100755
--- a/system/GLESv2_enc/GL2Encoder.cpp
+++ b/system/GLESv2_enc/GL2Encoder.cpp
@@ -1902,7 +1902,10 @@
                 break;
             }
         }
-        memcpy(source, returned.substr(0, bufsize - 1).c_str(), bufsize);
+        std::string ret = returned.substr(0, bufsize - 1);
+
+        size_t toCopy = bufsize < (ret.size() + 1) ? bufsize : ret.size() + 1;
+        memcpy(source, ret.c_str(), toCopy);
     }
 }
 
@@ -4123,6 +4126,7 @@
     assert(ctx->m_state != NULL);
     SET_ERROR_IF(!isValidDrawMode(mode), GL_INVALID_ENUM);
     SET_ERROR_IF(count < 0, GL_INVALID_VALUE);
+    SET_ERROR_IF(primcount < 0, GL_INVALID_VALUE);
 
     bool has_client_vertex_arrays = false;
     bool has_indirect_arrays = false;
@@ -4148,6 +4152,7 @@
     assert(ctx->m_state != NULL);
     SET_ERROR_IF(!isValidDrawMode(mode), GL_INVALID_ENUM);
     SET_ERROR_IF(count < 0, GL_INVALID_VALUE);
+    SET_ERROR_IF(primcount < 0, GL_INVALID_VALUE);
     SET_ERROR_IF(!(type == GL_UNSIGNED_BYTE || type == GL_UNSIGNED_SHORT || type == GL_UNSIGNED_INT), GL_INVALID_ENUM);
     SET_ERROR_IF(ctx->m_state->getTransformFeedbackActiveUnpaused(), GL_INVALID_OPERATION);