Merge "SurfaceFlinger: Fix integer overflow in Mesh ctor"
This commit is contained in:
commit
676d10b270
@ -16,14 +16,40 @@
|
||||
|
||||
#include "Mesh.h"
|
||||
|
||||
#include <utils/Log.h>
|
||||
|
||||
namespace android {
|
||||
|
||||
Mesh::Mesh(Primitive primitive, size_t vertexCount, size_t vertexSize, size_t texCoordSize)
|
||||
: mVertexCount(vertexCount), mVertexSize(vertexSize), mTexCoordsSize(texCoordSize),
|
||||
mPrimitive(primitive)
|
||||
{
|
||||
mVertices = new float[(vertexSize + texCoordSize) * vertexCount];
|
||||
mStride = mVertexSize + mTexCoordsSize;
|
||||
if (vertexCount == 0) {
|
||||
mVertices = new float[1];
|
||||
mVertices[0] = 0.0f;
|
||||
mStride = 0;
|
||||
return;
|
||||
}
|
||||
|
||||
size_t stride = vertexSize + texCoordSize;
|
||||
size_t remainder = (stride * vertexCount) / vertexCount;
|
||||
// Since all of the input parameters are unsigned, if stride is less than
|
||||
// either vertexSize or texCoordSize, it must have overflowed. remainder
|
||||
// will be equal to stride as long as stride * vertexCount doesn't overflow.
|
||||
if ((stride < vertexSize) || (remainder != stride)) {
|
||||
ALOGE("Overflow in Mesh(..., %zu, %zu, %zu)", vertexCount, vertexSize,
|
||||
texCoordSize);
|
||||
mVertices = new float[1];
|
||||
mVertices[0] = 0.0f;
|
||||
mVertexCount = 0;
|
||||
mVertexSize = 0;
|
||||
mTexCoordsSize = 0;
|
||||
mStride = 0;
|
||||
return;
|
||||
}
|
||||
|
||||
mVertices = new float[stride * vertexCount];
|
||||
mStride = stride;
|
||||
}
|
||||
|
||||
Mesh::~Mesh() {
|
||||
|
Loading…
Reference in New Issue
Block a user