Bug 802778 - Validate level parameter in copyTexImage2D. r=jgilbert, a=lsblakk
authorBenoit Jacob <bjacob@mozilla.com>
Fri, 09 Nov 2012 16:48:54 -0500
changeset 109798 24d7bd351f8dcfc9d0254e8e3640a43d637c7d7c
parent 109797 a61dc39f8fd7abef67956899f5dc7c4293ff5e92
child 109799 eed735ae1f1eca7f124fc05fb84a441d78fbf8dd
push id1681
push userryanvm@gmail.com
push dateSat, 10 Nov 2012 02:35:25 +0000
treeherdermozilla-beta@24d7bd351f8d [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjgilbert, lsblakk
bugs802778
milestone17.0
Bug 802778 - Validate level parameter in copyTexImage2D. r=jgilbert, a=lsblakk
content/canvas/src/WebGLContextGL.cpp
--- a/content/canvas/src/WebGLContextGL.cpp
+++ b/content/canvas/src/WebGLContextGL.cpp
@@ -891,16 +891,20 @@ WebGLContext::CopyTexSubImage2D_base(Web
                                      bool sub)
 {
     const WebGLRectangleObject *framebufferRect = FramebufferRectangleObject();
     WebGLsizei framebufferWidth = framebufferRect ? framebufferRect->Width() : 0;
     WebGLsizei framebufferHeight = framebufferRect ? framebufferRect->Height() : 0;
 
     const char *info = sub ? "copyTexSubImage2D" : "copyTexImage2D";
 
+    if (!ValidateLevelWidthHeightForTarget(target, level, width, height, info)) {
+        return;
+    }
+
     MakeContextCurrent();
 
     WebGLTexture *tex = activeBoundTextureForTarget(target);
 
     if (!tex)
         return ErrorInvalidOperation("%s: no texture is bound to this target");
 
     if (CanvasUtils::CheckSaneSubrectSize(x, y, width, height, framebufferWidth, framebufferHeight)) {