diff options
author | gman@chromium.org <gman@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-03-05 00:33:18 +0000 |
---|---|---|
committer | gman@chromium.org <gman@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-03-05 00:33:18 +0000 |
commit | a76b005bf78e63263abacfed35ad3e9ab3aef26a (patch) | |
tree | 25fe4a79a6ce254d1a331d0c533ddc79a0553d3f /webkit | |
parent | 0bc2448f867ad96f0cffe102cc4fc13aede5c891 (diff) | |
download | chromium_src-a76b005bf78e63263abacfed35ad3e9ab3aef26a.zip chromium_src-a76b005bf78e63263abacfed35ad3e9ab3aef26a.tar.gz chromium_src-a76b005bf78e63263abacfed35ad3e9ab3aef26a.tar.bz2 |
Added SafeMultiply and SafeAdd to check for overflows
in math calculations related to memory access.
Refactored code to use them where appropriate.
One issue that has come up is we need to make sure that
no GLES2 client call can crash the GPU process. In other
words, the GLES2Implementation must never generate a
command the service side will see as malicious.
For example: glTexImage2d(..width = 0x7fffffff, height = 0x7fffffff)
should return an gl error rather than pass it through to the
service side which will currently return a parse error and stop
the GPU process.
It does make me wonder if the service side should return GL errors
for more things rather than parse errors.
TEST=none
BUG=35942,35943,35941,35938
Review URL: http://codereview.chromium.org/669011
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@40696 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'webkit')
0 files changed, 0 insertions, 0 deletions