Validate that map_async's range is not negative.

map_async already checks that the range's end is within the bounds of the buffer, so this also ensures the range start is within bounds.
gfx-rs · Aug 3, 2022 · 3cf1501 · 3cf1501
1 parent 780209d
commit 3cf1501
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 1 deletion.
diff --git a/wgpu-core/src/device/mod.rs b/wgpu-core/src/device/mod.rs
@@ -5403,7 +5403,8 @@ impl<G: GlobalIdentityHandlerFactory> Global<G> {
                     BufferMapAsyncStatus::InvalidAlignment
                 }
                 &BufferAccessError::OutOfBoundsUnderrun { .. }
-                | &BufferAccessError::OutOfBoundsOverrun { .. } => {
+                | &BufferAccessError::OutOfBoundsOverrun { .. }
+                | &BufferAccessError::NegativeRange { .. } => {
                     BufferMapAsyncStatus::InvalidRange
                 }
                 _ => BufferMapAsyncStatus::Error,
@@ -5456,6 +5457,15 @@ impl<G: GlobalIdentityHandlerFactory> Global<G> {
                 return Err((op, e.into()));
             }
 
+            if range.start > range.end {
+                return Err((
+                    op,
+                    BufferAccessError::NegativeRange {
+                        start: range.start,
+                        end: range.end,
+                    },
+                ));
+            }
             if range.end > buffer.size {
                 return Err((
                     op,

diff --git a/wgpu-core/src/resource.rs b/wgpu-core/src/resource.rs
@@ -173,6 +173,11 @@ pub enum BufferAccessError {
         index: wgt::BufferAddress,
         max: wgt::BufferAddress,
     },
+    #[error("buffer map range start {start} is greater than end {end}")]
+    NegativeRange {
+        start: wgt::BufferAddress,
+        end: wgt::BufferAddress,
+    },
 }
 
 pub(crate) struct BufferPendingMapping {