Skip to content

Commit 7d75c96

Browse files
null77mibrunin
authored andcommitted
[Backport] CVE-2021-30547: Out of bounds write in ANGLE
Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/angle/angle/+/2937026: D3D11: Fix respecifying 3D textures. The missing check for the "Depth" dimension could lead to a bug where we would not recreate a texture when the dimension changed. Bug: chromium:1210414 Change-Id: Id59097ad14ae77ff80d27081f61786dad17a77ea Reviewed-by: Geoff Lang <geofflang@chromium.org> Commit-Queue: Jamie Madill <jmadill@chromium.org> (cherry picked from commit 2697358464cf20576701987f60300b6c4086c11e) Reviewed-by: Jamie Madill <jmadill@chromium.org> Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
1 parent 9ab150d commit 7d75c96

File tree

1 file changed

+2
-2
lines changed
  • chromium/third_party/angle/src/libANGLE/renderer/d3d/d3d11

1 file changed

+2
-2
lines changed

chromium/third_party/angle/src/libANGLE/renderer/d3d/d3d11/Image11.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -225,8 +225,8 @@ bool Image11::redefine(gl::TextureType type,
225225
const gl::Extents &size,
226226
bool forceRelease)
227227
{
228-
if (mWidth != size.width || mHeight != size.height || mInternalFormat != internalformat ||
229-
forceRelease)
228+
if (mWidth != size.width || mHeight != size.height || mDepth != size.depth ||
229+
mInternalFormat != internalformat || forceRelease)
230230
{
231231
// End the association with the TextureStorage, since that data will be out of date.
232232
// Also reset mRecoveredFromStorageCount since this Image is getting completely redefined.

0 commit comments

Comments
 (0)