[Backport] CVE-2022-0976: Heap buffer overflow in GPU

Manual backport of patch originally reviewed on
https://chromium-review.googlesource.com/c/angle/angle/+/3513754:
Vulkan: Fix issue with redefining a layered attachment.

The fix ensures we complete level redefinition before we get the
layer render target in TextureVk::getAttachmentRenderTarget.

Bug: chromium:1296866
Change-Id: I3ebe38f477fbb3eb4f0ad81634ccfb716f1699ca
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
Reviewed-by: Michal Klocek <michal.klocek@qt.io>

1 files changed, 17 insertions, 3 deletions

diff --git a/chromium/third_party/angle/src/libANGLE/renderer/vulkan/TextureVk.cpp b/chromium/third_party/angle/src/libANGLE/renderer/vulkan/TextureVk.cpp
index d3ac999806f..b42f2316fc3 100644
--- a/chromium/third_party/angle/src/libANGLE/renderer/vulkan/TextureVk.cpp
+++ b/chromium/third_party/angle/src/libANGLE/renderer/vulkan/TextureVk.cpp
@@ -2132,6 +2132,15 @@ angle::Result TextureVk::getAttachmentRenderTarget(const gl::Context *context,
 
     ContextVk *contextVk = vk::GetImpl(context);
 
+    if (mRedefinedLevels.any())
+    {
+        // If we have redefined levels, we must flush those out to fix the render targets.
+        ANGLE_TRY(respecifyImageStorage(contextVk));
+    }
+
+    // Otherwise, don't flush staged updates here. We'll handle that in FramebufferVk so we can
+    // defer clears.
+
     if (!mImage->valid())
     {
         const gl::ImageDesc &baseLevelDesc  = mState.getBaseLevelDesc();
@@ -2180,9 +2189,14 @@ angle::Result TextureVk::getAttachmentRenderTarget(const gl::Context *context,
     ANGLE_TRY(initRenderTargets(contextVk, layerCount, gl::LevelIndex(imageIndex.getLevelIndex()),
                                 renderToTextureIndex));
 
-    ASSERT(imageIndex.getLevelIndex() <
-           static_cast<int32_t>(mRenderTargets[renderToTextureIndex].size()));
-    *rtOut = &mRenderTargets[renderToTextureIndex][imageIndex.getLevelIndex()][layerIndex];
+    std::vector<RenderTargetVector> &levelRenderTargets =
+         mRenderTargets[renderToTextureIndex];
+    ASSERT(imageIndex.getLevelIndex() < static_cast<int32_t>(levelRenderTargets.size()));
+
+    RenderTargetVector &layerRenderTargets = levelRenderTargets[imageIndex.getLevelIndex()];
+    ASSERT(imageIndex.getLayerIndex() < static_cast<int32_t>(layerRenderTargets.size()));
+
+    *rtOut = &layerRenderTargets[layerIndex];
 
     return angle::Result::Continue;
 }