Files
servo/components/script/dom/webgl
Simon Martin 5634eab8cc webgl: check TexImage3D's input data length (#44270)
tex-3d-size-limit.html currently crashes because we don't check that the
input data is large enough, and happily access memory that's not ours if
it's not.

The referenced ticket comes from the fact that we don't systematically
detect a crash (which makes sense if we're (un)lucky), and this patch
eradicates the crash altogether by checking the input buffer size. The
size computation is a (partial) port of WPT's computeImageSizes3D JS
function.

Fixes: https://github.com/servo/servo/issues/42881
Testing: Some expected failures in wpt/webgl can be removed, including a
crash.

Signed-off-by: Simon Martin <simon@nasilyan.com>
2026-04-16 13:47:55 +00:00
..