Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Prevent a few integer overflows #5042

Merged
merged 3 commits into from
Jan 12, 2024
Merged

Prevent a few integer overflows #5042

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
149c102
Prevent a few integer overflows
nical Jan 11, 2024
7f6b299
Add a changelog entry
nical Jan 11, 2024
a481a31
use u64
nical Jan 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,6 +181,7 @@ Passing an owned value `window` to `Surface` will return a `Surface<'static>`. S
- `BufferMappedRange` trait is now `WasmNotSendSync`, i.e. it is `Send`/`Sync` if not on wasm or `fragile-send-sync-non-atomic-wasm` is enabled. By @wumpf in [#4818](https://github.com/gfx-rs/wgpu/pull/4818)
- Align `wgpu_types::CompositeAlphaMode` serde serialization to spec. By @littledivy in [#4940](https://github.com/gfx-rs/wgpu/pull/4940)
- Fix error message of `ConfigureSurfaceError::TooLarge`. By @Dinnerbone in [#4960](https://github.com/gfx-rs/wgpu/pull/4960)
- Fixed a number of panics. by @nical in [#4999](https://github.com/gfx-rs/wgpu/pull/4999), [#5014](https://github.com/gfx-rs/wgpu/pull/5014), [#5024](https://github.com/gfx-rs/wgpu/pull/5024), [#5025](https://github.com/gfx-rs/wgpu/pull/5025), [#5026](https://github.com/gfx-rs/wgpu/pull/5026), [#5027](https://github.com/gfx-rs/wgpu/pull/5027), [#5028](https://github.com/gfx-rs/wgpu/pull/5028) and [#5042](https://github.com/gfx-rs/wgpu/pull/5042).
cwfitzgerald marked this conversation as resolved.
Show resolved Hide resolved

#### DX12

Expand Down
25 changes: 15 additions & 10 deletions wgpu-core/src/command/render.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -335,7 +335,10 @@ impl IndexState {
IndexFormat::Uint16 => 1,
IndexFormat::Uint32 => 2,
};
((range.end - range.start) >> shift) as u32
// Ensure that the limit is always smaller than u32::MAX so that we can
// use saturating additions to catch case that would have caused integers
// overflow later.
((range.end - range.start) >> shift).min(u32::MAX as u64 - 1) as u32
}
None => 0,
}
Expand Down Expand Up @@ -382,13 +385,16 @@ struct VertexState {

impl VertexState {
fn update_limits(&mut self) {
self.vertex_limit = u32::MAX;
self.instance_limit = u32::MAX;
// Ensure that the limits are always smaller than u32::MAX so that
// interger overlows can be prevented via saturating additions.
let max = u32::MAX - 1;
self.vertex_limit = max;
self.instance_limit = max;
Wumpf marked this conversation as resolved.
Show resolved Hide resolved
for (idx, vbs) in self.inputs.iter().enumerate() {
if vbs.step.stride == 0 || !vbs.bound {
continue;
}
let limit = (vbs.total_size / vbs.step.stride) as u32;
let limit = (vbs.total_size / vbs.step.stride).min(max as u64) as u32;
match vbs.step.mode {
VertexStepMode::Vertex => {
if limit < self.vertex_limit {
Expand Down Expand Up @@ -1891,7 +1897,7 @@ impl<G: GlobalIdentityHandlerFactory> Global<G> {
};
state.is_ready(indexed).map_pass_err(scope)?;

let last_vertex = first_vertex + vertex_count;
let last_vertex = first_vertex.saturating_add(vertex_count);
cwfitzgerald marked this conversation as resolved.
Show resolved Hide resolved
let vertex_limit = state.vertex.vertex_limit;
if last_vertex > vertex_limit {
return Err(DrawError::VertexBeyondLimit {
Expand All @@ -1901,7 +1907,7 @@ impl<G: GlobalIdentityHandlerFactory> Global<G> {
})
.map_pass_err(scope);
}
let last_instance = first_instance + instance_count;
let last_instance = first_instance.saturating_add(instance_count);
let instance_limit = state.vertex.instance_limit;
if last_instance > instance_limit {
return Err(DrawError::InstanceBeyondLimit {
Expand Down Expand Up @@ -1933,9 +1939,8 @@ impl<G: GlobalIdentityHandlerFactory> Global<G> {
};
state.is_ready(indexed).map_pass_err(scope)?;

//TODO: validate that base_vertex + max_index() is
// within the provided range
let last_index = first_index + index_count;
// limit is always inferior to u32::MAX.
let last_index = first_index.saturating_add(index_count);
let index_limit = state.index.limit;
if last_index > index_limit {
return Err(DrawError::IndexBeyondLimit {
Expand All @@ -1944,7 +1949,7 @@ impl<G: GlobalIdentityHandlerFactory> Global<G> {
})
.map_pass_err(scope);
}
let last_instance = first_instance + instance_count;
let last_instance = first_instance.saturating_add(instance_count);
let instance_limit = state.vertex.instance_limit;
if last_instance > instance_limit {
return Err(DrawError::InstanceBeyondLimit {
Expand Down