commit f7fab5a259a86663b5bf8b429c44cd35c94d34f7
author Corentin Wallez <cwallez@chromium.org> Tue Jun 30 18:46:32 2020 +0000
committer Commit Bot service account <commit-bot@chromium.org> Tue Jun 30 18:46:32 2020 +0000
tree df7201d0c1b15c4d1321823a405d6a9187225815
parent 00d6215be9c8287d697b7cc3c9e2f7d2b3f0a68d

dawn_native: Use correct integer width for SetSubData.

SetSubData's count is a uint64_t while Queue::WriteBuffer's is a size_t
so we add a small validation check that no narrowing will occur.

No test is added because SetSubData will be removed soon, and it will be
hard to test because of the Null backend's artificial OOM.

This was found while debugging an unrelated fuzzer issue.

Bug: chromium:1099621
Change-Id: I27a9da2b94f51e889c5573f88d4a0a73fea5985c
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/23961
Reviewed-by: Stephen White <senorblanco@chromium.org>
Reviewed-by: Austin Eng <enga@chromium.org>
Commit-Queue: Corentin Wallez <cwallez@chromium.org>

src/dawn_native/Buffer.cpp

diff --git a/src/dawn_native/Buffer.cpp b/src/dawn_native/Buffer.cpp
index f4dc904..0e4c384 100644
--- a/src/dawn_native/Buffer.cpp
+++ b/src/dawn_native/Buffer.cpp
@@ -249,11 +249,15 @@
         }
     }
 
-    void BufferBase::SetSubData(uint32_t start, uint32_t count, const void* data) {
+    void BufferBase::SetSubData(uint64_t start, uint64_t count, const void* data) {
+        if (count > uint64_t(std::numeric_limits<size_t>::max())) {
+            GetDevice()->HandleError(InternalErrorType::Validation, "count too big");
+        }
+
         Ref<QueueBase> queue = AcquireRef(GetDevice()->GetDefaultQueue());
         GetDevice()->EmitDeprecationWarning(
             "Buffer::SetSubData is deprecated, use Queue::WriteBuffer instead");
-        queue->WriteBuffer(this, start, data, count);
+        queue->WriteBuffer(this, start, data, static_cast<size_t>(count));
     }
 
     void BufferBase::MapReadAsync(WGPUBufferMapReadCallback callback, void* userdata) {

src/dawn_native/Buffer.h

diff --git a/src/dawn_native/Buffer.h b/src/dawn_native/Buffer.h
index ef9224a..c4f1d32 100644
--- a/src/dawn_native/Buffer.h
+++ b/src/dawn_native/Buffer.h
@@ -58,7 +58,7 @@
         MaybeError ValidateCanUseOnQueueNow() const;
 
         // Dawn API
-        void SetSubData(uint32_t start, uint32_t count, const void* data);
+        void SetSubData(uint64_t start, uint64_t count, const void* data);
         void MapReadAsync(WGPUBufferMapReadCallback callback, void* userdata);
         void MapWriteAsync(WGPUBufferMapWriteCallback callback, void* userdata);
         void* GetMappedRange();