Translator: Don't cap object sizes to INT_MAX The calculations are done in size_t, so the cap is changed to size_t's MAX value instead. Fixes a crash if a _very_ big struct is declared, but used only in a way that's constant folded. The test itself is impossible to put in the CQ due to its long execution time. Bug: chromium:513468021 Change-Id: Ia378f915ed509ce52162153054229cc22a9a91af Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7865643 Commit-Queue: Shahbaz Youssefi <syoussefi@chromium.org> Reviewed-by: Geoff Lang <geofflang@chromium.org>
diff --git a/src/compiler/translator/Types.cpp b/src/compiler/translator/Types.cpp index a3564df..42ccdcc 100644 --- a/src/compiler/translator/Types.cpp +++ b/src/compiler/translator/Types.cpp
@@ -517,8 +517,10 @@ for (size_t arraySize : mArraySizes) { - if (arraySize > INT_MAX / totalSize) - totalSize = INT_MAX; + if (arraySize > std::numeric_limits<size_t>::max() / totalSize) + { + totalSize = std::numeric_limits<size_t>::max(); + } else totalSize *= arraySize; } @@ -877,8 +879,10 @@ for (const TField *field : *mFields) { size_t fieldSize = field->type()->getObjectSize(); - if (fieldSize > INT_MAX - size) - size = INT_MAX; + if (fieldSize > std::numeric_limits<size_t>::max() - size) + { + size = std::numeric_limits<size_t>::max(); + } else size += fieldSize; }