From 3ff819cc07be9f8a36c8294494da9b57bd2ed857 Mon Sep 17 00:00:00 2001
From: Corentin Wallez <[email protected]>
Date: Tue, 31 Mar 2026 10:09:22 -0700
Subject: [PATCH] GLES2 passthrough decoder: validate unpack buffer is bound.

In the handling of gl[Compressed]Tex[Sub]Image[2D/3D] the
data_shm_offset can be used either as an offset in the
GL_PIXEL_UNPACK_BUFFER or as a pointer to memory to upload to the GPU.
When data_shm_id is 0 and the data_shm_offset is not 0.

When both id and offset are 0, it is allowed to have no unpack buffer
because all [Compressed]TexImage[2D/3D] use that to specify a
zero-initialized data store, and the [Compressed]TexSubImage[2D/3D] all
validate that nullptr is only used with empty sizes.

Bug: 495373657
Change-Id: I14f6d15889e0e5afffa45b4bc9198e76fe286939
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7702692
Reviewed-by: Geoff Lang <[email protected]>
Auto-Submit: Corentin Wallez <[email protected]>
Commit-Queue: Corentin Wallez <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1607944}
---

diff --git a/gpu/command_buffer/service/gles2_cmd_decoder_passthrough.h b/gpu/command_buffer/service/gles2_cmd_decoder_passthrough.h
index 4b895e8..136dd7e 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder_passthrough.h
+++ b/gpu/command_buffer/service/gles2_cmd_decoder_passthrough.h
@@ -449,6 +449,19 @@
 
   error::Error ProcessReadPixels(bool did_finish);
 
+  // Validates the use of shm_offset as either an offset in a shmem, or in the
+  // unpack buffer. When using unpack buffers, data will be a zero-length span
+  // with the address corresponding to the offset in the unpack buffer. (so its
+  // .data() and .size() are the arguments to pass to the TexImage family of
+  // functions, without additional changes needed).
+  // image_size is the corresponding argument passed to CompressedTex[Sub]Image
+  // functions so it can be validated against the shmem size when there is no
+  // unpack buffer.
+  error::Error ValidateAndGetTexImageData(base::span<const uint8_t>* data,
+                                          uint32_t shm_id,
+                                          uint32_t shm_offset,
+                                          uint32_t image_size = 0);
+
   // Checks to see if the inserted fence has completed.
   void ProcessDescheduleUntilFinished();
 
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc b/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc
index 59b561a2..90d49da9 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc
+++ b/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc
@@ -10,6 +10,52 @@
 namespace gpu {
 namespace gles2 {
 
+error::Error GLES2DecoderPassthroughImpl::ValidateAndGetTexImageData(
+    base::span<const uint8_t>* data_out,
+    uint32_t shm_id,
+    uint32_t shm_offset,
+    uint32_t image_size) {
+  // When no unpack buffer is bound, only allow actual pointers to data, or
+  // nullptr (used to zero-initialize TexImage* and a GL error with non-empty
+  // uploads for TexSubImage).
+  if (bound_buffers_[GL_PIXEL_UNPACK_BUFFER] == 0) {
+    if (shm_id == 0) {
+      // data must be nullptr
+      if (image_size != 0) {
+        return error::kOutOfBounds;
+      }
+      if (shm_offset == 0) {
+        *data_out = {};
+        return error::kNoError;
+      }
+      return error::kInvalidArguments;
+    }
+
+    // data comes from shmem
+    unsigned int size = 0;
+    const uint8_t* data =
+        GetSharedMemoryAndSizeAs<const uint8_t*>(shm_id, shm_offset, 0, &size);
+    if (!data) {
+      return error::kOutOfBounds;
+    }
+    if (image_size > size) {
+      return error::kOutOfBounds;
+    }
+    *data_out = UNSAFE_TODO({data, size});
+    return error::kNoError;
+  }
+
+  // With an unpack buffer, no shmem can be used.
+  if (shm_id != 0) {
+    return error::kInvalidArguments;
+  }
+  // SAFETY: The span represents an offset in the unpack buffer, not actual
+  // memory. It's also of size 0.
+  *data_out = UNSAFE_BUFFERS(base::span<const uint8_t>(
+      reinterpret_cast<const uint8_t*>(static_cast<intptr_t>(shm_offset)), 0u));
+  return error::kNoError;
+}
+
 // Custom Handlers
 error::Error GLES2DecoderPassthroughImpl::HandleBindAttribLocationBucket(
     uint32_t immediate_data_size,
@@ -1046,22 +1092,15 @@
   uint32_t pixels_shm_id = c.pixels_shm_id;
   uint32_t pixels_shm_offset = c.pixels_shm_offset;
 
-  unsigned int buffer_size = 0;
-  const void* pixels = nullptr;
-
-  if (pixels_shm_id != 0) {
-    pixels = GetSharedMemoryAndSizeAs<uint8_t*>(
-        pixels_shm_id, pixels_shm_offset, 0, &buffer_size);
-    if (!pixels) {
-      return error::kOutOfBounds;
-    }
-  } else {
-    pixels =
-        reinterpret_cast<const void*>(static_cast<intptr_t>(pixels_shm_offset));
+  base::span<const uint8_t> pixels;
+  if (auto err =
+          ValidateAndGetTexImageData(&pixels, pixels_shm_id, pixels_shm_offset);
+      err != error::kNoError) {
+    return err;
   }
 
   return DoTexImage2D(target, level, internal_format, width, height, border,
-                      format, type, buffer_size, pixels);
+                      format, type, pixels.size(), pixels.data());
 }
 
 error::Error GLES2DecoderPassthroughImpl::HandleTexImage3D(
@@ -1084,22 +1123,15 @@
   uint32_t pixels_shm_id = c.pixels_shm_id;
   uint32_t pixels_shm_offset = c.pixels_shm_offset;
 
-  unsigned int buffer_size = 0;
-  const void* pixels = nullptr;
-
-  if (pixels_shm_id != 0) {
-    pixels = GetSharedMemoryAndSizeAs<uint8_t*>(
-        pixels_shm_id, pixels_shm_offset, 0, &buffer_size);
-    if (!pixels) {
-      return error::kOutOfBounds;
-    }
-  } else {
-    pixels =
-        reinterpret_cast<const void*>(static_cast<intptr_t>(pixels_shm_offset));
+  base::span<const uint8_t> pixels;
+  if (auto err =
+          ValidateAndGetTexImageData(&pixels, pixels_shm_id, pixels_shm_offset);
+      err != error::kNoError) {
+    return err;
   }
 
   return DoTexImage3D(target, level, internal_format, width, height, depth,
-                      border, format, type, buffer_size, pixels);
+                      border, format, type, pixels.size(), pixels.data());
 }
 
 error::Error GLES2DecoderPassthroughImpl::HandleTexSubImage2D(
@@ -1118,22 +1150,15 @@
   uint32_t pixels_shm_id = c.pixels_shm_id;
   uint32_t pixels_shm_offset = c.pixels_shm_offset;
 
-  unsigned int buffer_size = 0;
-  const void* pixels = nullptr;
-
-  if (pixels_shm_id != 0) {
-    pixels = GetSharedMemoryAndSizeAs<uint8_t*>(
-        pixels_shm_id, pixels_shm_offset, 0, &buffer_size);
-    if (!pixels) {
-      return error::kOutOfBounds;
-    }
-  } else {
-    pixels =
-        reinterpret_cast<const void*>(static_cast<intptr_t>(pixels_shm_offset));
+  base::span<const uint8_t> pixels;
+  if (auto err =
+          ValidateAndGetTexImageData(&pixels, pixels_shm_id, pixels_shm_offset);
+      err != error::kNoError) {
+    return err;
   }
 
   return DoTexSubImage2D(target, level, xoffset, yoffset, width, height, format,
-                         type, buffer_size, pixels);
+                         type, pixels.size(), pixels.data());
 }
 
 error::Error GLES2DecoderPassthroughImpl::HandleTexSubImage3D(
@@ -1157,22 +1182,16 @@
   uint32_t pixels_shm_id = c.pixels_shm_id;
   uint32_t pixels_shm_offset = c.pixels_shm_offset;
 
-  unsigned int buffer_size = 0;
-  const void* pixels = nullptr;
-
-  if (pixels_shm_id != 0) {