commit e1d0aa9f929659941e15c3d21e4a63199b70493f
author Shrek Shao <shrekshao@google.com> Fri Jul 08 14:42:24 2022 +0000
committer Dawn LUCI CQ <dawn-scoped@luci-project-accounts.iam.gserviceaccount.com> Fri Jul 08 14:42:24 2022 +0000
tree 8a517c453ed741df7b8ecaa26a14246b0e06aaf2
parent 2777cbc4415efdbd7d67a0cf2f95bc3825e1fe53

Inline memory transfer service offset bound update

Offset > 0 is already implicitly included in this if statement
(when `offset == 0` then `size > mDataLength` could safely assert it's invalid).
So we could remove it and use `offset > mDataLength` instead of `>=`.

Bug: chromium:1340654
Change-Id: Ieafe1ea6bef5aae29bc6ef2bd9702d6f7a92d8b5
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/95820
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Loko Kung <lokokung@google.com>
Kokoro: Kokoro <noreply+kokoro@google.com>
Commit-Queue: Shrek Shao <shrekshao@google.com>

src/dawn/wire/server/ServerInlineMemoryTransferService.cpp

diff --git a/src/dawn/wire/server/ServerInlineMemoryTransferService.cpp b/src/dawn/wire/server/ServerInlineMemoryTransferService.cpp
index 6f5884a..84ecb7b 100644
--- a/src/dawn/wire/server/ServerInlineMemoryTransferService.cpp
+++ b/src/dawn/wire/server/ServerInlineMemoryTransferService.cpp
@@ -55,7 +55,7 @@
                 deserializePointer == nullptr) {
                 return false;
             }
-            if ((offset >= mDataLength && offset > 0) || size > mDataLength - offset) {
+            if (offset > mDataLength || size > mDataLength - offset) {
                 return false;
             }
             memcpy(static_cast<uint8_t*>(mTargetData) + offset, deserializePointer, size);