From: Gert Wollny <gert.wollny@collabora.com>
Date: Mon, 2 Oct 2023 13:38:19 +0000 (+0200)
Subject: copyimage: check requested slice early when cube maps are involved
X-Git-Tag: upstream/23.3.3~1337
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=16662f8d3a57458325bd5381910722f67699fea6;p=platform%2Fupstream%2Fmesa.git

copyimage: check requested slice early when cube maps are involved

The generalized check for the z-slice happens in 'check_region_bounds',
but this function requires the image pointer that is acquired in
`prepare_target_err`, therefore replace the assertion with a proper test.

v2: Also check for negative value (Brian Paul)

CC: mesa-stable

Signed-off-by: Gert Wollny <gert.wollny@collabora.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/25507>
---

diff --git a/src/mesa/main/copyimage.c b/src/mesa/main/copyimage.c
index 3d0d8af..3fcfd3d 100644
--- a/src/mesa/main/copyimage.c
+++ b/src/mesa/main/copyimage.c
@@ -239,7 +239,11 @@ prepare_target_err(struct gl_context *ctx, GLuint name, GLenum target,
       if (target == GL_TEXTURE_CUBE_MAP) {
          int i;
 
-         assert(z < MAX_FACES);  /* should have been caught earlier */
+         if (z < 0 || z >= MAX_FACES) {
+            _mesa_error(ctx, GL_INVALID_VALUE,
+                        "glCopyImageSubData(cube face (%sZ = %d)", dbg_prefix, z);
+            return false;
+         }
 
          /* make sure all the cube faces are present */
          for (i = 0; i < depth; i++) {