diff --git a/src/dawn_wire/server/ServerBuffer.cpp b/src/dawn_wire/server/ServerBuffer.cpp index 7005f38987..05be903a5c 100644 --- a/src/dawn_wire/server/ServerBuffer.cpp +++ b/src/dawn_wire/server/ServerBuffer.cpp @@ -74,8 +74,12 @@ namespace dawn_wire { namespace server { userdata->requestSerial = requestSerial; userdata->mode = mode; - if (offset64 > std::numeric_limits::max() || - size64 > std::numeric_limits::max()) { + // Make sure that the deserialized offset and size are no larger than + // std::numeric_limits::max() so that they are CPU-addressable, and size is not + // WGPU_WHOLE_MAP_SIZE, which is by definition std::numeric_limits::max(). Since + // client does the default size computation, we should always have a valid actual size here + // in server. All other invalid actual size can be caught by dawn native side validation. + if (offset64 > std::numeric_limits::max() || size64 >= WGPU_WHOLE_MAP_SIZE) { OnBufferMapAsyncCallback(WGPUBufferMapAsyncStatus_Error, userdata.get()); return true; }