Bug 1427668 - Reject too-large MozFramebuffer requests. - r=daoshengmu

MozReview-Commit-ID: G2jqeb7QqhE

Author: kdashg

gfx/gl/GLContext.h

@@ -3621,11 +3621,10 @@ class GLContext
         return true;
     }
 
-
 public:
-    GLsizei MaxSamples() const {
-        return mMaxSamples;
-    }
+    auto MaxSamples() const { return uint32_t(mMaxSamples); }
+    auto MaxTextureSize() const { return uint32_t(mMaxTextureSize); }
+    auto MaxRenderbufferSize() const { return uint32_t(mMaxRenderbufferSize); }
 
 #ifdef MOZ_GL_DEBUG
     void CreatedProgram(GLContext* aOrigin, GLuint aName);

gfx/gl/GLScreenBuffer.cpp

@@ -817,7 +817,7 @@ DrawBuffer::Create(GLContext* const gl,
         if (formats.samples == 0)
             return false; // Can't create it.
 
-        MOZ_ASSERT(formats.samples <= gl->MaxSamples());
+        MOZ_ASSERT(uint32_t(formats.samples) <= gl->MaxSamples());
     }
 
     GLuint colorMSRB = 0;

gfx/gl/MozFramebuffer.cpp

@@ -35,12 +35,23 @@ MozFramebuffer::Create(GLContext* const gl, const gfx::IntSize& size,
     GLenum colorTarget;
     GLuint colorName;
     if (samples) {
+        if (uint32_t(size.width) > gl->MaxRenderbufferSize() ||
+            uint32_t(size.height) > gl->MaxRenderbufferSize() ||
+            samples > gl->MaxSamples())
+        {
+            return nullptr;
+        }
         colorTarget = LOCAL_GL_RENDERBUFFER;
         colorName = gl->CreateRenderbuffer();
         const ScopedBindRenderbuffer bindRB(gl, colorName);
         gl->fRenderbufferStorageMultisample(colorTarget, samples, LOCAL_GL_RGBA8,
                                             size.width, size.height);
     } else {
+        if (uint32_t(size.width) > gl->MaxTextureSize() ||
+            uint32_t(size.height) > gl->MaxTextureSize())
+        {
+            return nullptr;
+        }
         colorTarget = LOCAL_GL_TEXTURE_2D;
         colorName = gl->CreateTexture();
         const ScopedBindTexture bindTex(gl, colorName);