Fix validating glFramebuffer* attachment. The OpenGL ES 3.0 spec states: An INVALID_OPERATION error is generated if attachment is COLOR_- ATTACHMENTm where m is greater than or equal to the value of MAX_COLOR_- ATTACHMENTS. An INVALID_ENUM error is generated if attachment is not one of the attachments in table 4.6, and attachment is not COLOR_ATTACHMENTm where m is greater than or equal to the value of MAX_COLOR_ATTACHMENTS. Bug b/116776063 Change-Id: Iaabbcd3689d08ebdde2046440cf24554e9a160c2 Reviewed-on: https://swiftshader-review.googlesource.com/c/21908 Tested-by: Nicolas Capens <nicolascapens@google.com> Reviewed-by: Alexis Hétu <sugoi@google.com>
diff --git a/src/OpenGL/libGLESv2/libGLESv2.cpp b/src/OpenGL/libGLESv2/libGLESv2.cpp index ef00cc3..fd856e5 100644 --- a/src/OpenGL/libGLESv2/libGLESv2.cpp +++ b/src/OpenGL/libGLESv2/libGLESv2.cpp
@@ -1927,10 +1927,16 @@ framebuffer->setStencilbuffer(GL_RENDERBUFFER, renderbuffer); break; default: - if((attachment - GL_COLOR_ATTACHMENT0) >= MAX_COLOR_ATTACHMENTS) + if(attachment < GL_COLOR_ATTACHMENT0 || attachment > GL_COLOR_ATTACHMENT31) { return error(GL_INVALID_ENUM); } + + if((attachment - GL_COLOR_ATTACHMENT0) >= MAX_COLOR_ATTACHMENTS) + { + return error(GL_INVALID_OPERATION); + } + framebuffer->setColorbuffer(GL_RENDERBUFFER, renderbuffer, attachment - GL_COLOR_ATTACHMENT0); break; } @@ -2036,10 +2042,16 @@ framebuffer->setStencilbuffer(textarget, texture, level); break; default: - if((attachment - GL_COLOR_ATTACHMENT0) >= MAX_COLOR_ATTACHMENTS) + if(attachment < GL_COLOR_ATTACHMENT0 || attachment > GL_COLOR_ATTACHMENT31) { return error(GL_INVALID_ENUM); } + + if((attachment - GL_COLOR_ATTACHMENT0) >= MAX_COLOR_ATTACHMENTS) + { + return error(GL_INVALID_OPERATION); + } + framebuffer->setColorbuffer(textarget, texture, attachment - GL_COLOR_ATTACHMENT0, level); break; } @@ -2614,14 +2626,21 @@ } break; default: - if((unsigned int)(attachment - GL_COLOR_ATTACHMENT0) < MAX_COLOR_ATTACHMENTS) + if(framebufferName == 0) { - if(framebufferName == 0) - { - return error(GL_INVALID_OPERATION); - } + return error(GL_INVALID_OPERATION); } - else return error(GL_INVALID_ENUM); + + if(attachment < GL_COLOR_ATTACHMENT0 || attachment > GL_COLOR_ATTACHMENT31) + { + return error(GL_INVALID_ENUM); + } + + if((attachment - GL_COLOR_ATTACHMENT0) >= MAX_COLOR_ATTACHMENTS) + { + return error(GL_INVALID_OPERATION); + } + break; } es2::Framebuffer *framebuffer = context->getFramebuffer(framebufferName); @@ -6063,10 +6082,16 @@ case GL_DEPTH_ATTACHMENT: framebuffer->setDepthbuffer(textarget, texture, level); break; case GL_STENCIL_ATTACHMENT: framebuffer->setStencilbuffer(textarget, texture, level); break; default: - if((attachment - GL_COLOR_ATTACHMENT0) >= MAX_COLOR_ATTACHMENTS) + if(attachment < GL_COLOR_ATTACHMENT0 || attachment > GL_COLOR_ATTACHMENT31) { return error(GL_INVALID_ENUM); } + + if((attachment - GL_COLOR_ATTACHMENT0) >= MAX_COLOR_ATTACHMENTS) + { + return error(GL_INVALID_OPERATION); + } + framebuffer->setColorbuffer(textarget, texture, attachment - GL_COLOR_ATTACHMENT0, level); break; }
diff --git a/src/OpenGL/libGLESv2/libGLESv3.cpp b/src/OpenGL/libGLESv2/libGLESv3.cpp index 2669739..6ba4c9d 100644 --- a/src/OpenGL/libGLESv2/libGLESv3.cpp +++ b/src/OpenGL/libGLESv2/libGLESv3.cpp
@@ -1294,40 +1294,6 @@ switch(attachment) { - case GL_COLOR_ATTACHMENT0: - case GL_COLOR_ATTACHMENT1: - case GL_COLOR_ATTACHMENT2: - case GL_COLOR_ATTACHMENT3: - case GL_COLOR_ATTACHMENT4: - case GL_COLOR_ATTACHMENT5: - case GL_COLOR_ATTACHMENT6: - case GL_COLOR_ATTACHMENT7: - case GL_COLOR_ATTACHMENT8: - case GL_COLOR_ATTACHMENT9: - case GL_COLOR_ATTACHMENT10: - case GL_COLOR_ATTACHMENT11: - case GL_COLOR_ATTACHMENT12: - case GL_COLOR_ATTACHMENT13: - case GL_COLOR_ATTACHMENT14: - case GL_COLOR_ATTACHMENT15: - case GL_COLOR_ATTACHMENT16: - case GL_COLOR_ATTACHMENT17: - case GL_COLOR_ATTACHMENT18: - case GL_COLOR_ATTACHMENT19: - case GL_COLOR_ATTACHMENT20: - case GL_COLOR_ATTACHMENT21: - case GL_COLOR_ATTACHMENT22: - case GL_COLOR_ATTACHMENT23: - case GL_COLOR_ATTACHMENT24: - case GL_COLOR_ATTACHMENT25: - case GL_COLOR_ATTACHMENT26: - case GL_COLOR_ATTACHMENT27: - case GL_COLOR_ATTACHMENT28: - case GL_COLOR_ATTACHMENT29: - case GL_COLOR_ATTACHMENT30: - case GL_COLOR_ATTACHMENT31: - framebuffer->setColorbuffer(textarget, texture, attachment - GL_COLOR_ATTACHMENT0, level, layer); - break; case GL_DEPTH_ATTACHMENT: framebuffer->setDepthbuffer(textarget, texture, level, layer); break; @@ -1339,7 +1305,18 @@ framebuffer->setStencilbuffer(textarget, texture, level, layer); break; default: - return error(GL_INVALID_ENUM); + if(attachment < GL_COLOR_ATTACHMENT0 || attachment > GL_COLOR_ATTACHMENT31) + { + return error(GL_INVALID_ENUM); + } + + if((attachment - GL_COLOR_ATTACHMENT0) >= MAX_COLOR_ATTACHMENTS) + { + return error(GL_INVALID_OPERATION); + } + + framebuffer->setColorbuffer(textarget, texture, attachment - GL_COLOR_ATTACHMENT0, level, layer); + break; } } }