From 00208bd134e55768833665500d1579c1bf897641 Mon Sep 17 00:00:00 2001 From: Corentin Wallez Date: Fri, 6 Jan 2023 14:28:24 +0000 Subject: [PATCH] Fix CopyExternalTextureForBrowserTests overflow. The call to Queue::WriteTexture was passing a size that was bigger than the array of data being used. This caused an ASAN failure when running with the wire, because the serialization of the command would memcpy past the end of the data. Bug: dawn:1625 Change-Id: I2a00f2e32e3d8f8ff66d85575d1908480861f153 Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/116288 Reviewed-by: Austin Eng Commit-Queue: Corentin Wallez Kokoro: Kokoro --- .../tests/end2end/CopyExternalTextureForBrowserTests.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/dawn/tests/end2end/CopyExternalTextureForBrowserTests.cpp b/src/dawn/tests/end2end/CopyExternalTextureForBrowserTests.cpp index 66024c324b..07ccb93dc6 100644 --- a/src/dawn/tests/end2end/CopyExternalTextureForBrowserTests.cpp +++ b/src/dawn/tests/end2end/CopyExternalTextureForBrowserTests.cpp @@ -77,7 +77,8 @@ class CopyExternalTextureForBrowserTests : public Parent { wgpu::TextureDataLayout externalTexturePlane0DataLayout = {}; externalTexturePlane0DataLayout.bytesPerRow = 4; - this->queue.WriteTexture(&plane0, yPlaneData.data(), yPlaneData.size() * sizeof(float), + this->queue.WriteTexture(&plane0, yPlaneData.data(), + yPlaneData.size() * sizeof(yPlaneData[0]), &externalTexturePlane0DataLayout, &externalTexturePlane0Desc.size); // uv plane @@ -99,7 +100,8 @@ class CopyExternalTextureForBrowserTests : public Parent { wgpu::TextureDataLayout externalTexturePlane1DataLayout = {}; externalTexturePlane1DataLayout.bytesPerRow = 4; - this->queue.WriteTexture(&plane1, uvPlaneData.data(), uvPlaneData.size() * sizeof(float), + this->queue.WriteTexture(&plane1, uvPlaneData.data(), + uvPlaneData.size() * sizeof(uvPlaneData[0]), &externalTexturePlane1DataLayout, &externalTexturePlane1Desc.size); // Create an ExternalTextureDescriptor from the texture views