swung0x48/MobileGL
1
0
Fork 0
mirror of https://github.com/MobileGL-Dev/MobileGL synced 2026-11-16 06:23:23 +09:00
Code Issues Packages Projects Releases Wiki Activity

[MG_Remote] validate packed readback bounds before copying GPU replies

Browse Source
This commit is contained in:
swung0x48
2026-09-20 11:56:05 -04:00
parent 70df57bb23
commit 859c0efb01
2 changed files with 71 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MobileGL/MG_Remote/Client/EmitTables.cpp
+9 -2
View File
@@ -902,6 +902,8 @@ namespace MobileGL::MG_Remote::Client {
}
}
#include "TextureReadbackEmit.inc"
void EmitReadPixels(GLint x, GLint y, GLsizei width, GLsizei height, GLenum format,
GLenum type, void* pixels) {
ClientSession& session = RequireSession("ReadPixels");
@@ -968,6 +970,13 @@ namespace MobileGL::MG_Remote::Client {
if (MG_State::pGLContext != nullptr) {
pack = MG_State::pGLContext->GetPixelStoreParameters(/*isUnpack=*/false);
}
ReadbackLayout layout;
const SizeT pboOffset = reinterpret_cast<SizeT>(pixels);
if (!CheckedReadbackLayout(width, height, 1, bytesPerPixel, pack, false, layout) ||
(pbo && (pboOffset > pbo->GetSize() || layout.End > pbo->GetSize() - pboOffset))) {
RecordReadbackRangeError("ReadPixels");
return;
}
Int32 status = 0;
Uint64 replySize = 0;
@@ -1014,8 +1023,6 @@ namespace MobileGL::MG_Remote::Client {
pack);
}
#include "TextureReadbackEmit.inc"
void EmitPresent() {
ClientSession& session = RequireSession("Present");
BeforeReadOnlyVerb();