guix-devel/gnu/packages/patches/icecat-CVE-2015-7201-pt1.patch

124 lines
4.9 KiB
Diff

From e2bbd632e220be7626efd34acb9a517430d36004 Mon Sep 17 00:00:00 2001
From: Andrew Comminos <andrew@comminos.com>
Date: Fri, 23 Oct 2015 21:35:16 -0700
Subject: [PATCH] Bug 1203135 - Terminate linking if maximum vertex attribute
count is exceeded on Mesa. r=jgilbert, a=ritu
--HG--
extra : source : 8021382da9722db0ad97ebd93698b69a74f0d9b0
extra : intermediate-source : 90eff805d2810e9d9ea88f6869335b0500b1a536
---
dom/canvas/WebGLProgram.cpp | 28 ++++++++++++++++++----------
dom/canvas/WebGLShader.cpp | 10 ++++++++++
dom/canvas/WebGLShader.h | 1 +
dom/canvas/WebGLShaderValidator.cpp | 6 ++++++
dom/canvas/WebGLShaderValidator.h | 1 +
5 files changed, 36 insertions(+), 10 deletions(-)
diff --git a/dom/canvas/WebGLProgram.cpp b/dom/canvas/WebGLProgram.cpp
index 78f7413..0e056e8 100644
--- a/dom/canvas/WebGLProgram.cpp
+++ b/dom/canvas/WebGLProgram.cpp
@@ -569,18 +569,26 @@ WebGLProgram::LinkProgram()
gl::GLContext* gl = mContext->gl;
gl->MakeCurrent();
- // Bug 777028: Mesa can't handle more than 16 samplers per program,
- // counting each array entry.
- size_t numSamplerUniforms_upperBound = mVertShader->CalcNumSamplerUniforms() +
- mFragShader->CalcNumSamplerUniforms();
if (gl->WorkAroundDriverBugs() &&
- mContext->mIsMesa &&
- numSamplerUniforms_upperBound > 16)
+ mContext->mIsMesa)
{
- mLinkLog.AssignLiteral("Programs with more than 16 samplers are disallowed on"
- " Mesa drivers to avoid crashing.");
- mContext->GenerateWarning("linkProgram: %s", mLinkLog.BeginReading());
- return false;
+ // Bug 777028: Mesa can't handle more than 16 samplers per program,
+ // counting each array entry.
+ size_t numSamplerUniforms_upperBound = mVertShader->CalcNumSamplerUniforms() +
+ mFragShader->CalcNumSamplerUniforms();
+ if (numSamplerUniforms_upperBound > 16) {
+ mLinkLog.AssignLiteral("Programs with more than 16 samplers are disallowed on"
+ " Mesa drivers to avoid crashing.");
+ mContext->GenerateWarning("linkProgram: %s", mLinkLog.BeginReading());
+ return false;
+ }
+
+ // Bug 1203135: Mesa crashes internally if we exceed the reported maximum attribute count.
+ if (mVertShader->NumAttributes() > mContext->MaxVertexAttribs()) {
+ mLinkLog.AssignLiteral("Number of attributes exceeds Mesa's reported max attribute count.");
+ mContext->GenerateWarning("linkProgram: %s", mLinkLog.BeginReading());
+ return false;
+ }
}
// Bind the attrib locations.
diff --git a/dom/canvas/WebGLShader.cpp b/dom/canvas/WebGLShader.cpp
index 85a3809..bab4157 100644
--- a/dom/canvas/WebGLShader.cpp
+++ b/dom/canvas/WebGLShader.cpp
@@ -299,6 +299,16 @@ WebGLShader::CalcNumSamplerUniforms() const
return 0;
}
+size_t
+WebGLShader::NumAttributes() const
+{
+ if (mValidator)
+ return mValidator->NumAttributes();
+
+ // TODO
+ return 0;
+}
+
void
WebGLShader::BindAttribLocation(GLuint prog, const nsCString& userName,
GLuint index) const
diff --git a/dom/canvas/WebGLShader.h b/dom/canvas/WebGLShader.h
index 698e30c..2c80b16a 100644
--- a/dom/canvas/WebGLShader.h
+++ b/dom/canvas/WebGLShader.h
@@ -45,6 +45,7 @@ public:
// Util funcs
bool CanLinkTo(const WebGLShader* prev, nsCString* const out_log) const;
size_t CalcNumSamplerUniforms() const;
+ size_t NumAttributes() const;
void BindAttribLocation(GLuint prog, const nsCString& userName, GLuint index) const;
bool FindAttribUserNameByMappedName(const nsACString& mappedName,
nsDependentCString* const out_userName) const;
diff --git a/dom/canvas/WebGLShaderValidator.cpp b/dom/canvas/WebGLShaderValidator.cpp
index 80005e2..8bedf88 100644
--- a/dom/canvas/WebGLShaderValidator.cpp
+++ b/dom/canvas/WebGLShaderValidator.cpp
@@ -274,6 +274,12 @@ ShaderValidator::CalcNumSamplerUniforms() const
return accum;
}
+size_t
+ShaderValidator::NumAttributes() const
+{
+ return ShGetAttributes(mHandle)->size();
+}
+
// Attribs cannot be structs or arrays, and neither can vertex inputs in ES3.
// Therefore, attrib names are always simple.
bool
diff --git a/dom/canvas/WebGLShaderValidator.h b/dom/canvas/WebGLShaderValidator.h
index 35db2f1..1f794bf0 100644
--- a/dom/canvas/WebGLShaderValidator.h
+++ b/dom/canvas/WebGLShaderValidator.h
@@ -41,6 +41,7 @@ public:
void GetOutput(nsACString* out) const;
bool CanLinkTo(const ShaderValidator* prev, nsCString* const out_log) const;
size_t CalcNumSamplerUniforms() const;
+ size_t NumAttributes() const;
bool FindAttribUserNameByMappedName(const std::string& mappedName,
const std::string** const out_userName) const;
--
2.6.3