From 2787d1570675796b55fc0440d5c4672991683480 Mon Sep 17 00:00:00 2001 From: Swung0x48 Date: Wed, 12 Aug 2026 09:19:50 -0400 Subject: [PATCH] [Fix] (MG_Impl): the compressed sub-image bounds check added two application-supplied ints --- MobileGL/MG_Impl/GLImpl/Texture/GL_Texture.cpp | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/MobileGL/MG_Impl/GLImpl/Texture/GL_Texture.cpp b/MobileGL/MG_Impl/GLImpl/Texture/GL_Texture.cpp index 19ab48dc..c0262acd 100644 --- a/MobileGL/MG_Impl/GLImpl/Texture/GL_Texture.cpp +++ b/MobileGL/MG_Impl/GLImpl/Texture/GL_Texture.cpp @@ -3547,7 +3547,12 @@ namespace MobileGL::MG_Impl::GLImpl { } const IntVec3 levelSize = textureMipmapObject->GetMipmapTexelSize(textureUploadTarget, static_cast(level)); - if (xoffset < 0 || yoffset < 0 || xoffset + width > levelSize.x() || yoffset + height > levelSize.y()) { + // Written as a subtraction rather than `xoffset + width > levelSize.x()`: both operands + // are application-supplied GLints, so the sum is free to overflow, and a signed overflow + // is undefined behaviour that a compiler may resolve by assuming the check passes. + // levelSize is our own and non-negative, and the offsets are known non-negative by the + // time the subtraction runs, so this form cannot wrap. + if (xoffset < 0 || yoffset < 0 || width > levelSize.x() - xoffset || height > levelSize.y() - yoffset) { MG_State::pGLContext->RecordError( ErrorCode::InvalidValue, MakeUnique("MG_Impl/GLImpl", __func__,