swung0x48/MobileGL
1
0
Fork 0
mirror of https://github.com/MobileGL-Dev/MobileGL synced 2026-11-07 01:53:24 +09:00
Code Issues Packages Projects Releases Wiki Activity

[Magma] reject truncated or overflowing RGB staging before expansion

Browse Source
This commit is contained in:
swung0x48
2026-09-20 12:51:17 -04:00
parent 677922a930
commit d339053ea6
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MobileGL/MG_Backend/DirectVulkan/Renderer/VkTextureManager.cpp
+9 -1
View File
@@ -460,8 +460,16 @@ namespace MobileGL::MG_Backend::DirectVulkan {
MOBILEGL_ASSERT(formatInfo.componentByteCount > 0,
"ExpandRgbSourceToRgba: invalid component size for expanded RGB format");
if (!source || texelSize.x() <= 0 || texelSize.y() <= 0 || !formatInfo.componentByteCount ||
formatInfo.componentByteCount > formatInfo.alphaBytes.size()) return false;
const SizeT depth = static_cast<SizeT>(std::max(texelSize.z(), 1));
const SizeT pixelCount = static_cast<SizeT>(texelSize.x()) * static_cast<SizeT>(texelSize.y()) * depth;
const SizeT width = static_cast<SizeT>(texelSize.x());
const SizeT height = static_cast<SizeT>(texelSize.y());
if (height > std::numeric_limits<SizeT>::max() / width ||
depth > std::numeric_limits<SizeT>::max() / width / height) return false;
const SizeT pixelCount = width * height * depth;
if (pixelCount > std::numeric_limits<SizeT>::max() / (formatInfo.componentByteCount * 4) ||
sourceByteSize != pixelCount * formatInfo.componentByteCount * 3) return false;
MOBILEGL_ASSERT(pixelCount > 0, "ExpandRgbSourceToRgba: invalid texel size (%d, %d, %d)",
texelSize.x(), texelSize.y(), texelSize.z());
MOBILEGL_ASSERT(sourceByteSize == pixelCount * formatInfo.componentByteCount * 3,