From 2b3a653dda35893442fbda35c6d8f89b0c683002 Mon Sep 17 00:00:00 2001
From: Brandon Jones <[email protected]>
Date: Tue, 11 Aug 2026 18:38:56 -0700
Subject: [PATCH] Validate framebufferTextureMultiviewOVR target, attachment

Previously these were being passed through unvalidated, which could
lead to resource tracking issues if an out-of-range value was
given. While the extension definitions for this method don't state
any explicit validation to perform on these values it should be
safe to assume they should be treated like values being passed to
framebufferTexture2D, and thus the same validation is reused here.

Fixed: 543082390
Change-Id: I63a172b6723e6e5a626d50583668b4dc0ca2a33a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8243727
Commit-Queue: Kai Ninomiya <[email protected]>
Reviewed-by: Kai Ninomiya <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1677709}
---

diff --git a/third_party/blink/renderer/modules/webgl/ovr_multiview_2.cc b/third_party/blink/renderer/modules/webgl/ovr_multiview_2.cc
index 8af07167..2633c7b 100644
--- a/third_party/blink/renderer/modules/webgl/ovr_multiview_2.cc
+++ b/third_party/blink/renderer/modules/webgl/ovr_multiview_2.cc
@@ -62,6 +62,11 @@
              ->ValidateTexFuncLayer("framebufferTextureMultiviewOVR", textarget,
                                     base_view_index + num_views - 1))
       return;
+    if (!static_cast<WebGL2RenderingContextBase*>(scoped.Context())
+             ->ValidateFramebufferFuncParameters(
+                 "framebufferTextureMultiviewOVR", target, attachment)) {
+      return;
+    }
     if (!scoped.Context()->ValidateTexFuncLevel(
             "framebufferTextureMultiviewOVR", textarget, level))
       return;