diff options
| author | Jack Palevich <jackpal@google.com> | 2009-10-23 17:39:47 -0700 |
|---|---|---|
| committer | Android Git Automerger <android-git-automerger@android.com> | 2009-10-23 17:39:47 -0700 |
| commit | a2ec1f4cea5531fb824b3fb2802ef4573a4916d9 (patch) | |
| tree | 6a0ec30eaa261b0fd250ab8aefb4d0e5cce35760 /core/jni | |
| parent | b81199b3eed6f6079e5dc7bedeaa50712f3d9b11 (diff) | |
| parent | 8f89a1a360465e08e81ceca3cb3042606a98668b (diff) | |
| download | frameworks_base-a2ec1f4cea5531fb824b3fb2802ef4573a4916d9.zip frameworks_base-a2ec1f4cea5531fb824b3fb2802ef4573a4916d9.tar.gz frameworks_base-a2ec1f4cea5531fb824b3fb2802ef4573a4916d9.tar.bz2 | |
am 8f89a1a3: Merge change Ic620a52b into eclair
Merge commit '8f89a1a360465e08e81ceca3cb3042606a98668b' into eclair-mr2
* commit '8f89a1a360465e08e81ceca3cb3042606a98668b':
Add size checks for glBufferData and glBufferSubData
Diffstat (limited to 'core/jni')
| -rw-r--r-- | core/jni/android_opengl_GLES11.cpp | 12 | ||||
| -rw-r--r-- | core/jni/com_google_android_gles_jni_GLImpl.cpp | 12 |
2 files changed, 24 insertions, 0 deletions
diff --git a/core/jni/android_opengl_GLES11.cpp b/core/jni/android_opengl_GLES11.cpp index ed8dfc8..44213ed 100644 --- a/core/jni/android_opengl_GLES11.cpp +++ b/core/jni/android_opengl_GLES11.cpp @@ -144,6 +144,10 @@ android_glBufferData__IILjava_nio_Buffer_2I if (data_buf) { data = (GLvoid *)getPointer(_env, data_buf, &_array, &_remaining); + if (_remaining < size) { + _env->ThrowNew(IAEClass, "remaining() < size"); + goto exit; + } } glBufferData( (GLenum)target, @@ -151,6 +155,8 @@ android_glBufferData__IILjava_nio_Buffer_2I (GLvoid *)data, (GLenum)usage ); + +exit: if (_array) { releasePointer(_env, _array, data, JNI_FALSE); } @@ -165,12 +171,18 @@ android_glBufferSubData__IIILjava_nio_Buffer_2 GLvoid *data = (GLvoid *) 0; data = (GLvoid *)getPointer(_env, data_buf, &_array, &_remaining); + if (_remaining < size) { + _env->ThrowNew(IAEClass, "remaining() < size"); + goto exit; + } glBufferSubData( (GLenum)target, (GLintptr)offset, (GLsizeiptr)size, (GLvoid *)data ); + +exit: if (_array) { releasePointer(_env, _array, data, JNI_FALSE); } diff --git a/core/jni/com_google_android_gles_jni_GLImpl.cpp b/core/jni/com_google_android_gles_jni_GLImpl.cpp index 89b1f96..3e0aea5 100644 --- a/core/jni/com_google_android_gles_jni_GLImpl.cpp +++ b/core/jni/com_google_android_gles_jni_GLImpl.cpp @@ -3593,6 +3593,10 @@ android_glBufferData__IILjava_nio_Buffer_2I if (data_buf) { data = (GLvoid *)getPointer(_env, data_buf, &_array, &_remaining); + if (_remaining < size) { + _env->ThrowNew(IAEClass, "remaining() < size"); + goto exit; + } } glBufferData( (GLenum)target, @@ -3600,6 +3604,8 @@ android_glBufferData__IILjava_nio_Buffer_2I (GLvoid *)data, (GLenum)usage ); + +exit: if (_array) { releasePointer(_env, _array, data, JNI_FALSE); } @@ -3614,12 +3620,18 @@ android_glBufferSubData__IIILjava_nio_Buffer_2 GLvoid *data = (GLvoid *) 0; data = (GLvoid *)getPointer(_env, data_buf, &_array, &_remaining); + if (_remaining < size) { + _env->ThrowNew(IAEClass, "remaining() < size"); + goto exit; + } glBufferSubData( (GLenum)target, (GLintptr)offset, (GLsizeiptr)size, (GLvoid *)data ); + +exit: if (_array) { releasePointer(_env, _array, data, JNI_FALSE); } |