diff options
| author | Jack Palevich <jackpal@google.com> | 2009-10-23 17:55:49 -0700 |
|---|---|---|
| committer | Android Git Automerger <android-git-automerger@android.com> | 2009-10-23 17:55:49 -0700 |
| commit | 31f4c2d653324bd8cbe7470e2f8bdb36c2196194 (patch) | |
| tree | 5328e4b7e89b7694800c226a9fca5d129521a16b /core/jni | |
| parent | 80448892e4ef8234885f3fadb13b59761918e096 (diff) | |
| parent | a904672996c60c4ec50439a8d2be04fd9bd6444c (diff) | |
| download | frameworks_base-31f4c2d653324bd8cbe7470e2f8bdb36c2196194.zip frameworks_base-31f4c2d653324bd8cbe7470e2f8bdb36c2196194.tar.gz frameworks_base-31f4c2d653324bd8cbe7470e2f8bdb36c2196194.tar.bz2 | |
am a9046729: am a2ec1f4c: am 8f89a1a3: Merge change Ic620a52b into eclair
Merge commit 'a904672996c60c4ec50439a8d2be04fd9bd6444c'
* commit 'a904672996c60c4ec50439a8d2be04fd9bd6444c':
Add size checks for glBufferData and glBufferSubData
Diffstat (limited to 'core/jni')
| -rw-r--r-- | core/jni/android_opengl_GLES11.cpp | 12 | ||||
| -rw-r--r-- | core/jni/com_google_android_gles_jni_GLImpl.cpp | 12 |
2 files changed, 24 insertions, 0 deletions
diff --git a/core/jni/android_opengl_GLES11.cpp b/core/jni/android_opengl_GLES11.cpp index ed8dfc8..44213ed 100644 --- a/core/jni/android_opengl_GLES11.cpp +++ b/core/jni/android_opengl_GLES11.cpp @@ -144,6 +144,10 @@ android_glBufferData__IILjava_nio_Buffer_2I if (data_buf) { data = (GLvoid *)getPointer(_env, data_buf, &_array, &_remaining); + if (_remaining < size) { + _env->ThrowNew(IAEClass, "remaining() < size"); + goto exit; + } } glBufferData( (GLenum)target, @@ -151,6 +155,8 @@ android_glBufferData__IILjava_nio_Buffer_2I (GLvoid *)data, (GLenum)usage ); + +exit: if (_array) { releasePointer(_env, _array, data, JNI_FALSE); } @@ -165,12 +171,18 @@ android_glBufferSubData__IIILjava_nio_Buffer_2 GLvoid *data = (GLvoid *) 0; data = (GLvoid *)getPointer(_env, data_buf, &_array, &_remaining); + if (_remaining < size) { + _env->ThrowNew(IAEClass, "remaining() < size"); + goto exit; + } glBufferSubData( (GLenum)target, (GLintptr)offset, (GLsizeiptr)size, (GLvoid *)data ); + +exit: if (_array) { releasePointer(_env, _array, data, JNI_FALSE); } diff --git a/core/jni/com_google_android_gles_jni_GLImpl.cpp b/core/jni/com_google_android_gles_jni_GLImpl.cpp index 89b1f96..3e0aea5 100644 --- a/core/jni/com_google_android_gles_jni_GLImpl.cpp +++ b/core/jni/com_google_android_gles_jni_GLImpl.cpp @@ -3593,6 +3593,10 @@ android_glBufferData__IILjava_nio_Buffer_2I if (data_buf) { data = (GLvoid *)getPointer(_env, data_buf, &_array, &_remaining); + if (_remaining < size) { + _env->ThrowNew(IAEClass, "remaining() < size"); + goto exit; + } } glBufferData( (GLenum)target, @@ -3600,6 +3604,8 @@ android_glBufferData__IILjava_nio_Buffer_2I (GLvoid *)data, (GLenum)usage ); + +exit: if (_array) { releasePointer(_env, _array, data, JNI_FALSE); } @@ -3614,12 +3620,18 @@ android_glBufferSubData__IIILjava_nio_Buffer_2 GLvoid *data = (GLvoid *) 0; data = (GLvoid *)getPointer(_env, data_buf, &_array, &_remaining); + if (_remaining < size) { + _env->ThrowNew(IAEClass, "remaining() < size"); + goto exit; + } glBufferSubData( (GLenum)target, (GLintptr)offset, (GLsizeiptr)size, (GLvoid *)data ); + +exit: if (_array) { releasePointer(_env, _array, data, JNI_FALSE); } |