Hash :
0e19adb2
Author :
Date :
2024-04-08T13:21:09
Validate non-negative vertex attribute offsets. When robust buffer access is enabled, validat that buffers cannot be read with a negative index. Bug: chromium:323699974 Change-Id: I05beb72c60832ab4decbf16c47b3d92bd374286b Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/5435736 Reviewed-by: Shahbaz Youssefi <syoussefi@chromium.org> Commit-Queue: Geoff Lang <geofflang@chromium.org>
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168
//
// Copyright 2014 The ANGLE Project Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Implementation of the state classes for mananging GLES 3.1 Vertex Array Objects.
//
#include "libANGLE/VertexAttribute.h"
namespace gl
{
// [OpenGL ES 3.1] (November 3, 2016) Section 20 Page 361
// Table 20.2: Vertex Array Object State
VertexBinding::VertexBinding() : VertexBinding(0) {}
VertexBinding::VertexBinding(GLuint boundAttribute) : mStride(16u), mDivisor(0), mOffset(0)
{
mBoundAttributesMask.set(boundAttribute);
}
VertexBinding::VertexBinding(VertexBinding &&binding)
{
*this = std::move(binding);
}
VertexBinding::~VertexBinding() {}
VertexBinding &VertexBinding::operator=(VertexBinding &&binding)
{
if (this != &binding)
{
mStride = binding.mStride;
mDivisor = binding.mDivisor;
mOffset = binding.mOffset;
mBoundAttributesMask = binding.mBoundAttributesMask;
std::swap(binding.mBuffer, mBuffer);
}
return *this;
}
void VertexBinding::onContainerBindingChanged(const Context *context, int incr) const
{
if (mBuffer.get())
mBuffer->onNonTFBindingChanged(incr);
}
VertexAttribute::VertexAttribute(GLuint bindingIndex)
: enabled(false),
format(&angle::Format::Get(angle::FormatID::R32G32B32A32_FLOAT)),
pointer(nullptr),
relativeOffset(0),
vertexAttribArrayStride(0),
bindingIndex(bindingIndex),
mCachedElementLimit(0)
{}
VertexAttribute::VertexAttribute(VertexAttribute &&attrib)
: enabled(attrib.enabled),
format(attrib.format),
pointer(attrib.pointer),
relativeOffset(attrib.relativeOffset),
vertexAttribArrayStride(attrib.vertexAttribArrayStride),
bindingIndex(attrib.bindingIndex),
mCachedElementLimit(attrib.mCachedElementLimit)
{}
VertexAttribute &VertexAttribute::operator=(VertexAttribute &&attrib)
{
if (this != &attrib)
{
enabled = attrib.enabled;
format = attrib.format;
pointer = attrib.pointer;
relativeOffset = attrib.relativeOffset;
vertexAttribArrayStride = attrib.vertexAttribArrayStride;
bindingIndex = attrib.bindingIndex;
mCachedElementLimit = attrib.mCachedElementLimit;
}
return *this;
}
void VertexAttribute::updateCachedElementLimit(const VertexBinding &binding)
{
Buffer *buffer = binding.getBuffer().get();
if (!buffer)
{
mCachedElementLimit = 0;
return;
}
angle::CheckedNumeric<GLint64> bufferOffset(binding.getOffset());
angle::CheckedNumeric<GLint64> bufferSize(buffer->getSize());
angle::CheckedNumeric<GLint64> attribOffset(relativeOffset);
angle::CheckedNumeric<GLint64> attribSize(ComputeVertexAttributeTypeSize(*this));
// Disallow referencing data before the start of the buffer with negative offsets
angle::CheckedNumeric<GLint64> offset = bufferOffset + attribOffset;
if (!offset.IsValid() || offset.ValueOrDie() < 0)
{
mCachedElementLimit = kIntegerOverflow;
return;
}
// The element limit is (exclusive) end of the accessible range for the vertex. For example, if
// N attributes can be accessed, the following calculates N.
//
// (buffer.size - buffer.offset - attrib.relativeOffset - attrib.size) / binding.stride + 1
angle::CheckedNumeric<GLint64> elementLimit = (bufferSize - offset - attribSize);
// Use the special integer overflow value if there was a math error.
if (!elementLimit.IsValid())
{
static_assert(kIntegerOverflow < 0, "Unexpected value");
mCachedElementLimit = kIntegerOverflow;
return;
}
mCachedElementLimit = elementLimit.ValueOrDie();
if (mCachedElementLimit < 0)
{
return;
}
if (binding.getStride() == 0)
{
// Special case for a zero stride. If we can fit one vertex we can fit infinite vertices.
mCachedElementLimit = std::numeric_limits<GLint64>::max();
return;
}
mCachedElementLimit /= binding.getStride();
++mCachedElementLimit;
}
size_t ComputeVertexAttributeStride(const VertexAttribute &attrib, const VertexBinding &binding)
{
// In ES 3.1, VertexAttribPointer will store the type size in the binding stride.
// Hence, rendering always uses the binding's stride.
return attrib.enabled ? binding.getStride() : 16u;
}
// Warning: you should ensure binding really matches attrib.bindingIndex before using this function.
GLintptr ComputeVertexAttributeOffset(const VertexAttribute &attrib, const VertexBinding &binding)
{
return attrib.relativeOffset + binding.getOffset();
}
size_t ComputeVertexBindingElementCount(GLuint divisor, size_t drawCount, size_t instanceCount)
{
// For instanced rendering, we draw "instanceDrawCount" sets of "vertexDrawCount" vertices.
//
// A vertex attribute with a positive divisor loads one instanced vertex for every set of
// non-instanced vertices, and the instanced vertex index advances once every "mDivisor"
// instances.
if (instanceCount > 0 && divisor > 0)
{
// When instanceDrawCount is not a multiple attrib.divisor, the division must round up.
// For instance, with 5 non-instanced vertices and a divisor equal to 3, we need 2 instanced
// vertices.
return (instanceCount + divisor - 1u) / divisor;
}
return drawCount;
}
} // namespace gl